CVE-2026-57443: Unauthenticated Operations API Information Disclosure in SCBE-AETHERMOORE

Vulnerability ID: CVE-2026-57443
CVSS Score: 7.5
Published: 2026-09-25

An unauthenticated remote information disclosure vulnerability exists in the SCBE-AETHERMOORE geometric AI governance framework. The API endpoint /api/ops/check-email allows unauthenticated network actors to trigger administrative subprocesses and retrieve sensitive operator email digests from Gmail or ProtonMail mailboxes due to missing authentication controls and overly permissive CORS configurations.

TL;DR

An unauthenticated operations API endpoint in SCBE-AETHERMOORE allows remote attackers to execute a background email harvesting subprocess and retrieve sensitive operator email digests without credentials.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-306
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• CVSS v3.1: 7.5 (High)
• Exploit Status: PoC Available
• CISA KEV Status: Not Listed

Affected Systems

• SCBE-AETHERMOORE
• SCBE-AETHERMOORE: >= 4.0.2, < 4.2.1 (Fixed in: 4.2.1)

Mitigation Strategies

• Upgrade SCBE-AETHERMOORE to version 4.2.1 or higher.
• Set the SCBE_OPS_ADMIN_TOKEN environment variable to enforce authentication.
• Configure the API server host to bind strictly to localhost (127.0.0.1) instead of 0.0.0.0.
• Restrict the FastAPI CORS configuration to trusted domains only instead of wildcard '*'

Remediation Steps:

1. Identify running instances of SCBE-AETHERMOORE and determine the current version in use.
2. Pull the latest framework updates or execute an upgrade to version 4.2.1 or newer.
3. Generate a high-entropy secret token (e.g., openssl rand -hex 32).
4. Export the token as an environment variable: export SCBE_OPS_ADMIN_TOKEN='your_secure_token'.
5. Modify configuration files or startup scripts to bind the FastAPI app to localhost: python scripts/aetherbrowser/api_server.py --host 127.0.0.1.
6. Restart the service to apply changes and verify that unauthenticated calls to /api/ops/check-email are blocked with a 403 or 401 status code.

References

• GitHub Security Advisory GHSA-q986-4x7x-gx39
• Fix Commit 1
• Fix Commit 2
• Official CVE Record

Read the full report for CVE-2026-57443 on our website for more details including interactive diagrams and full exploit analysis.