CVE-2026-114611
CriticalCVSS 9.1Summary
In OCO-Server prior to 1.2.3, the Apple MDM enrollment endpoint (frontend/api-mdm.php) verifies the signed enrollment-request plist with PKCS7_NOVERIFY, which disables signer certificate chain and trust validation. As a result, an attacker can sign a forged plist with any self-signed certificate, supply a known device's serial number, and via an unauthenticated request obtain the victim's MDM identity (certificate and private key) and overwrite the device record in the database.
Risk Assessment
An attacker can hijack the victim device's MDM relationship, read its management data, replace its push token, and disrupt or redirect its enrollment. Only knowledge of a registered device's serial number is required, and the request needs no authentication.
Recommendation
Update OCO-Server to version 1.2.3 or later, which fixes the issue. Until patched, restrict access to the /api-mdm.php endpoint and monitor for unusual enrollment requests.
Other vulnerabilities in OCO-Server
See all- CVE-2026-61791High
OCO-Server before 1.2.1 has a vulnerability where Html::commandButton() in lib/Html.class.php embeds an action URL containing a stored computer hostname into a JavaScript string in an inline onclick handler, using htmlspecialchars(ENT_QUOTES) only for HTML escaping. Browsers decode HTML entities before interpreting the handler as JavaScript, so a crafted hostname can escape the string and execute script in an administrator's authenticated session when an affected command button is activated. A remote attacker with the shared agent-registration-key can store an unchecked hostname via oco.agent.hello when agent self-registration is enabled (disabled by default). The issue is fixed in version 1.2.1.
- CVE-2026-114515Medium
OCO-Server prior to 1.2.3 allows a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package to queue an uninstall job without deploy permission for those resources. The permission-check loop continues after denied checks without removing rejected IDs, then passes the original list to the uninstall function, which is executed in system context.
Original NVD description (English source)
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`. `PKCS7_NOVERIFY` disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the `SERIAL` field taken from the unverified payload, anyone who knows a registered device's serial number can sign a forged plist (`SERIAL` = victim device, attacker-chosen `UDID`) with an arbitrary self-signed certificate; POST it unauthenticated to `/api-mdm.php/profile` (Content-Type: `application/pkcs7-signature`); and receive the victim device's freshly minted MDM identity: a certificate with `CN=<serial>` issued by the server's internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned `.mobileconfig` enrollment profile. Additionally, the victim's `mobile_device` database row is silently overwritten with the attacker-supplied `UDID` (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (`/checkin`, `/mdm`, `/parameters`), which authenticate callers by the certificate CN (the serial number) via `checkSignature()` in the same file. This yields control over the victim device's MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS