GPlatform Control
/gelhaus-solutions/public/gpcontrol
Published advisories
Atom feedGSSA-2026-09-HREC4XSeptember 14, 2026Cloud broker issues and replaces application credentials without authentication
The application registration endpoint on the cloud broker verified no credential before issuing one. A caller naming an existing application instance received a valid credential for it, and the stored credential was replaced. Rotation did not remediate the issue.
CriticalGSSA-2026-09-CDC8AGSeptember 14, 2026Failed second-factor codes are not counted toward account lockout
A failed password attempt counted toward an account lockout; a failed one-time code did not, on either sign in or re-authentication, and no rate limiting applied. An attacker holding a valid password could guess the second factor without limit.
HighGSSA-2026-09-KNEEEVSeptember 14, 2026Privileged administrative operations did not declare required roles
Role requirements were declared per operation and most privileged operations declared none, which admitted any role. The lowest-privilege role, assigned by default when an account is created without one, could change customer licensing and publish signed software.
High