Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
CVE-2026-114611
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint frontend/api-mdm.php verifies the signed enrollment-request plist with openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...). PKCS7_NOVERIFY disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the SERIAL field taken from the unverified payload, anyone who knows a registered device's serial number can sign a forged plist (SERIAL = victim device, attacker-chosen UDID) with an arbitrary self-signed certificate; POST it unauthenticated to /api-mdm.php/profile (Content-Type: application/pkcs7-signature); and receive the victim device's freshly minted MDM identity: a certificate with CN=<serial> issued by the server's internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned .mobileconfig enrollment profile. Additionally, the victim's mobile_device database row is silently overwritten with the attacker-supplied UDID (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (/checkin, /mdm, /parameters), which authenticate callers by the certificate CN (the serial number) via checkSignature() in the same file. This yields control over the victim device's MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue.
Upload your own SBOM in CycloneDX 1.6 or higher (JSON) directly here to check your vulnerabilities.
Drag and drop some file here, or click to select
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a high impact on the confidentiality of the information. There is a high impact on the integrity of the data.
Exploitation activity has been observed. Apply available patches or mitigations urgently.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard