Cosmos-Server version 0.22.18 improperly handles bearer tokens on the GET /cosmos/api/constellation/public-devices endpoint; any non-empty Authorization header is accepted, the token is stripped but never validated, allowing an attacker to retrieve Constellation device metadata without authenticating. This results in sensitive data exposure such as device identifiers and connectivity information, corresponding to CWE-287 – Improper Authentication.

The affected product is Cosmos-Server by azukaar, specifically version 0.22.18. All later releases, beginning with 0.22.19, contain the fix.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is below 1 %, showing a low probability of exploitation in the general population, and the vulnerability is not listed in the CISA KEV catalog. Because any observer with network access to the public endpoint can send a request with an arbitrary Authorization header, exploitation is trivial and requires no special credentials. The attack vector is remote and the impact is limited to leaking device metadata, but the exposure of such data can aid further reconnaissance or privacy‑violation attacks.