Tattile Cameras Insufficient Token Expiration Vulnerability (CVE-2026-26342)

Title: Tattile Cameras 1.181.5 Insufficient Token (X-User-Token) Expiration Advisory ID: ZSL-2026-5976 Type: Local/Remote Impact: Security Bypass Risk: (3/5) Release Date: 24.02.2026 Summary The application is affected by insufficient session expiration. This vulnerability occurs when the web application permits attackers to reuse outdated session credentials or tokens, thereby increasing exposure to attacks capable of stealing or reusing user session identifiers. Vendor Vendor: Tattile s.r.l. - ![](https://www.tattile.com) Affected Version Smart+ family: Smart+, Tapping+, Smart+ Speed, Smart+ Traffic Light Vega family: Axle Counter, Vega 53, Vegas33 & Vega 11 Basic family: Basic MK2 ANPR Mobile Firmware: 1.181.5 Tested On lighthttpd/1.4.64 Vendor Status Vulnerability discovered on 22.01.2026 Vendor contacted on 22.01.2026 Vendor responded, requested account registration details, and confirmed ticket creation on 23.01.2026 Vendor provided additional information on 23.01.2026; some details were obtained from the vendor Collaborated with the vendor on 26.01.2026 Status update requested on 06.02.2026 Vendor assessed the issue on 10.02.2026 Vendor confirmed the vulnerability and scheduled patch planning for May 2026 on 11.02.2026 Vendor provided further vulnerability details and requested confirmation on 18.02.2026 Vendor confirmed affected models and firmware versions on 20.02.2026 Response sent to vendor on 20.02.2026 Vendor reviewed draft advisories on 23.02.2026 Public security advisory released on 24.02.2026 POC Check attachment: ![](tattile_token.txt) Credits Vulnerability discovered by Gjoko Kretic References 1. ![](https://www.cve.org/CVERecord?id=CVE-2026-26342) Changelog 24.02.2026 - Initial release Contact Zero Science Lab: ![](https://www.zeroscience.mk) ![](lab@zeroscience.mk)

Goal Reached Thanks to every supporter — we hit 100%!

Tattile Cameras Insufficient Token Expiration Vulnerability (CVE-2026-26342)