{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "Unauthenticated POST /api/master/console/register with a known existing console asset ID",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "OpenRemote manager 1.25.0 (vendor OCI image bytes)",
    "OpenRemote manager 1.26.2 fixed control (vendor OCI image bytes)",
    "OpenRemote Keycloak 23.0.7.6 (vendor OCI image bytes)",
    "PostgreSQL 18 with PostGIS and TimescaleDB"
  ],
  "proof_artifacts": [
    "logs/reproduction_steps.log",
    "logs/keycloak-service.log",
    "logs/vulnerable-attempt-1-service.log",
    "logs/vulnerable-attempt-2-service.log",
    "logs/fixed-attempt-1-service.log",
    "logs/fixed-attempt-2-service.log",
    "artifacts/openremote-console-cve-2026-66013/image-identities.json",
    "artifacts/openremote-console-cve-2026-66013/vulnerable-attempt-1/attacker-overwrite.request.txt",
    "artifacts/openremote-console-cve-2026-66013/vulnerable-attempt-1/attacker-overwrite.response.headers",
    "artifacts/openremote-console-cve-2026-66013/vulnerable-attempt-1/attacker-overwrite.response.json",
    "artifacts/openremote-console-cve-2026-66013/vulnerable-attempt-1/persisted-state.json",
    "artifacts/openremote-console-cve-2026-66013/vulnerable-attempt-2/attacker-overwrite.response.json",
    "artifacts/openremote-console-cve-2026-66013/vulnerable-attempt-2/persisted-state.json",
    "artifacts/openremote-console-cve-2026-66013/fixed-attempt-1/attacker-overwrite.response.headers",
    "artifacts/openremote-console-cve-2026-66013/fixed-attempt-1/persisted-state.json",
    "artifacts/openremote-console-cve-2026-66013/fixed-attempt-2/attacker-overwrite.response.headers",
    "artifacts/openremote-console-cve-2026-66013/fixed-attempt-2/persisted-state.json"
  ],
  "notes": "Two vulnerable 1.25.0 product attempts accepted and persisted anonymous known-ID metadata/token overwrites of owner-linked console assets; two fixed 1.26.2 attempts returned HTTP 403 and retained original state."
}