Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens (CVE-2026-49447) | HOL Guard CVE