Tattile Smart+, Vega, and Basic Families Insufficient Session Token Expiration Vulnerability

A vulnerability exists in Tattile Smart+, Vega, and Basic device families, specifically in firmware versions through 1.181.5. These devices implement an authentication token, X-User-Token, with inadequate expiration. This flaw allows an attacker who obtains a valid token—potentially through interception, log exposure, or token reuse on a shared system—to maintain authentication to the management interface until the token is revoked. Consequently, this enables unauthorized access to device functions and data.

Impact

Exploitation of this vulnerability allows for unauthorized access to the management interface, enabling a bypass of authentication and access to device functions and data.

Remediation

Tattile has acknowledged this vulnerability and plans to release a patch in May 2026. For the latest information on the vulnerability and its remediation, Tattile users can refer to the Tattile Academy portal.