Is CVE-2026-110097 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110097?

CVE-2026-110097 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-110097

Description

Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to gain full account access, including the master administrator.