What’s Vulnerable › Vulnerabilities

CVE-2026-26342: Tattile Smart+ / Vega / Basic <= 1.181.5 Insufficient Session Token Expiration

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-24 · updated 2026-06-17
• Weakness: CWE-613

Description

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with insufficient expiration. An attacker who obtains a valid token (for example via interception, log exposure, or token reuse on a shared system) can continue to authenticate to the management interface until the token is revoked, enabling unauthorized access to device functions and data.

Affected products

• Tattile Anpr Mobile Firmware: through 1.181.5
• Tattile Axle Counter Firmware: through 1.181.5
• Tattile Basic Mk2 Firmware: through 1.181.5
• Tattile Smart+ Firmware: through 1.181.5
• Tattile Smart+ Speed Firmware: through 1.181.5
• Tattile Smart+ Traffic Light Firmware: through 1.181.5
• Tattile Tolling+ Firmware: through 1.181.5
• Tattile Vega11 Firmware: through 1.181.5
• Tattile Vega33 Firmware: through 1.181.5
• Tattile Vega53 Firmware: through 1.181.5

References

• https://www.tattile.com/
• https://www.vulncheck.com/advisories/tattile-smart-vega-basic-insufficient-session-token-expiration
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5976.php

Get alerted when CVE-2026-26342 or the next vulnerability affects your stack