LibreNMS before 26.8.0 contains an authentication bypass vulnerability in its REST API caused by token type confusion, enabling numeric values to be interpreted as valid authentication tokens through MySQL type coercion. This issue is a type‑confusion vulnerability (CWE‑287). By supplying small integers from 0 to 9, an unauthenticated attacker can bypass normal authentication checks and gain full access to protected API endpoints. This privilege includes retrieving device credentials and executing administrative functions that can result in remote code execution through vulnerable alert templates.

The affected product is LibreNMS distributed by the librenms vendor. All releases prior to version 26.8.0 are vulnerable and do not contain the necessary token validation fix. Version 26.8.0 and later release the patch that resolves the type‑confusion issue.

The CVSS score of 9.2 classifies this flaw as Critical. The EPSS score of 4% indicates a relatively high likelihood that the vulnerability will be exploited on the internet. The vulnerability is a direct REST API attack with no special prerequisites, making it highly exploitable once an attacker can reach the API. It is not currently listed in the CISA KEV catalog, but its high attack surface and remote code execution potential warrant immediate concern. Attackers would typically reach the vulnerable endpoint over HTTP or HTTPS, sending numeric token values to impersonate valid authentication and commandeer administrative capabilities.