openblue

  1. OpenBlue CVE-2025-26381: Forced Browsing in Mobile Web App Patch 2025.1.3

    Johnson Controls has reported a vulnerability in the OpenBlue Mobile Web Application for OpenBlue Workplace — tracked as CVE‑2025‑26381 — that allows direct request (commonly called “forced browsing”) exploitation leading to unauthorized access to sensitive information; Johnson Controls...