Common Weakness Enumeration
CWE-1394
Weakness AllowedUse of Default Cryptographic Key
Abstraction: Base · Status: Incomplete
The product uses a default cryptographic key for potentially critical functionality.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
Architecture and Design
It is common practice for products to be designed to use default keys. The rationale is to simplify the manufacturing process or the system administrator's task of installation and deployment into an enterprise. However, there is a risk that admins might not change the defaults.
Content history
Submission: CWE Content Team
· MITRE
· 2022-10-07
· CWE 4.9
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated Relationships
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes
Modification: CWE Content Team
· MITRE
· 2025-12-11
· CWE 4.19
updated Weakness_Ordinalities
Modification: CWE Content Team
· MITRE
· 2026-10-28
· CWE 5.0
updated Common_Consequences, Description, Modes_of_Introduction
52 vulnerabilities reference this CWE, most recent first.
CVE-2026-121818 (GCVE-0-2026-121818)
Vulnerability from cvelistv5 – Published: 2026-11-04 06:26 – Updated: 2026-11-04 20:00
VLAI
EPSS
VEX
Title
About Time Technologies｜Herowatch Go - Security Misconfiguration
Summary
Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:28 UTC
CWE
- CWE-1394 - Use of Default Cryptographic Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/en/cp-139-11362-1e829-2.html | third-party-advisory |
| https://www.twcert.org.tw/tw/cp-132-11360-ab123-1.html | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| About Time Technologies | Herowatch Go |
Affected:
all
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121818",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T18:28:13.244033Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:00:58.496Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Herowatch Go",
"vendor": "About Time Technologies",
"versions": [
{
"status": "affected",
"version": "all",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eHerowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code.\u003c/p\u003e"
}
],
"value": "Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1394",
"description": "CWE-1394 Use of Default Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T06:56:13.525Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-11362-1e829-2.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-11360-ab123-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe product is no longer maintained. Users are advised to replace it with a supported device.\u003c/p\u003e"
}
],
"value": "The product is no longer maintained. Users are advised to replace it with a supported device."
}
],
"source": {
"advisory": "TVN-202611003",
"discovery": "EXTERNAL"
},
"title": "About Time Technologies\uff5cHerowatch Go - Security Misconfiguration",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2026-121818",
"datePublished": "2026-11-04T06:26:53.550Z",
"dateReserved": "2026-11-04T05:40:25.201Z",
"dateUpdated": "2026-11-04T20:00:58.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120442 (GCVE-0-2026-120442)
Vulnerability from cvelistv5 – Published: 2026-11-02 14:29 – Updated: 2026-11-05 21:39
VLAI
EPSS
VEX
Title
ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass
Summary
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:38 UTC
CWE
- CWE-1394 - Use of Default Cryptographic Key
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/xianhc/ape-volo-admin/issues/36 | issue-tracking |
| https://github.com/xianhc/ape-volo-admin/commit/9… | patch |
| https://github.com/xianhc/ape-volo-admin/releases… | release-notes |
| https://github.com/xianhc/ape-volo-admin/blob/V3.… | technical-description |
| https://github.com/xianhc/ape-volo-admin/blob/V3.… | technical-description |
| https://github.com/xianhc/ape-volo-admin/blob/V3.… | technical-description |
| https://hackmd.io/@hieuPenguinnn/ape-volo-admin-h… | technical-description |
| https://www.vulncheck.com/advisories/ape-volo-adm… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xianhc | ape-volo-admin |
Affected:
0 , < 3.6.1
(semver)
|
Date Public
2026-10-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120442",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:38:59.409940Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:39:20.223Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ape-volo-admin",
"repo": "https://github.com/xianhc/ape-volo-admin",
"vendor": "xianhc",
"versions": [
{
"lessThan": "3.6.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1394",
"description": "Use of Default Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:29:03.407Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/xianhc/ape-volo-admin/issues/36"
},
{
"tags": [
"patch"
],
"url": "https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933"
},
{
"name": "ape-volo-admin V3.6.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Api/appsettings.json#L4-L10"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Extensions/AuthorizationExtensions.cs#L50-L60"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Authentication/PermissionHandler.cs#L130-L172"
},
{
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@hieuPenguinnn/ape-volo-admin-hardcoded-jwt-secret-admin-token-forgery"
},
{
"name": "VulnCheck Advisory: ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ape-volo-admin-before-3.6.1-hardcoded-jwt-signing-key-authentication-bypass"
}
],
"title": "ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120442",
"datePublished": "2026-11-02T14:29:03.407Z",
"dateReserved": "2026-11-02T12:42:16.749Z",
"dateUpdated": "2026-11-05T21:39:20.223Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119660 (GCVE-0-2026-119660)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-11-05 21:34
VLAI
EPSS
VEX
Title
MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key
Summary
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:33 UTC
CWE
- CWE-1394 - Use of Default Cryptographic Key
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/yincongcyincong/MuseBot/issues/61 | issue-tracking |
| https://github.com/yincongcyincong/MuseBot/commit… | patch |
| https://github.com/yincongcyincong/MuseBot/commit… | patch |
| https://github.com/yincongcyincong/MuseBot/blob/v… | technical-description |
| https://github.com/yincongcyincong/MuseBot/blob/v… | technical-description |
| https://hackmd.io/@hieuPenguinnn/musebot-admin-de… | third-party-advisory |
| https://github.com/yincongcyincong/MuseBot | product |
| https://www.vulncheck.com/advisories/musebot-befo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| yincongcyincong | MuseBot |
Affected:
0 , < 2.0.0
(semver)
|
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119660",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:33:48.218500Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:34:06.489Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/musebot-admin-default-session-key-auth-bypass"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MuseBot",
"repo": "https://github.com/yincongcyincong/MuseBot",
"vendor": "yincongcyincong",
"versions": [
{
"lessThan": "2.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
},
{
"lang": "en",
"type": "remediation developer",
"value": "yincongcyincong"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key \u0027muse_bot_session_key\u0027. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1394",
"description": "Use of Default Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:21.246Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/yincongcyincong/MuseBot/issues/61"
},
{
"tags": [
"patch"
],
"url": "https://github.com/yincongcyincong/MuseBot/commit/3e64518948fe7037058f07ef987d35216c3f0cae"
},
{
"tags": [
"patch"
],
"url": "https://github.com/yincongcyincong/MuseBot/commit/139f6158b50283b983d76976f593a3a09a064681"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/conf/conf.go#L28"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/controller/login.go#L19-L88"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/musebot-admin-default-session-key-auth-bypass"
},
{
"tags": [
"product"
],
"url": "https://github.com/yincongcyincong/MuseBot"
},
{
"name": "VulnCheck Advisory: MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/musebot-before-2.0.0-authentication-bypass-via-hard-coded-session-key"
}
],
"title": "MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119660",
"datePublished": "2026-10-30T14:16:21.246Z",
"dateReserved": "2026-10-30T13:43:49.076Z",
"dateUpdated": "2026-11-05T21:34:06.489Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111367 (GCVE-0-2026-111367)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-21 01:53
VLAI
EPSS
VEX
Title
BillionMail through 4.9 Forgeable JWTs via Default Signing Key
Summary
BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm to deactivate any contact or force confirmed subscriptions.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 01:52 UTC
CWE
- CWE-1394 - Use of Default Cryptographic Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/billionmail-unsu… | third-party-advisory |
| https://github.com/aaPanel/BillionMail/blob/v4.9/… | technical-description |
| https://github.com/aaPanel/BillionMail/blob/v4.9/… | technical-description |
| https://github.com/aaPanel/BillionMail | product |
| https://www.vulncheck.com/advisories/billionmail-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| aaPanel | BillionMail |
Affected:
0 , ≤ 4.9
(custom)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111367",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T01:52:47.127044Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T01:53:10.056Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/billionmail-unsubscribe-subscribe-jwt-deterministic-secret-forgery"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/aaPanel/BillionMail",
"product": "BillionMail",
"repo": "https://github.com/aaPanel/BillionMail",
"vendor": "aaPanel",
"versions": [
{
"lessThanOrEqual": "4.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm to deactivate any contact or force confirmed subscriptions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1394",
"description": "Use of Default Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:50.886Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/billionmail-unsubscribe-subscribe-jwt-deterministic-secret-forgery"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/aaPanel/BillionMail/blob/v4.9/core/internal/service/batch_mail/jwt.go#L98-L123"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/aaPanel/BillionMail/blob/v4.9/core/manifest/config/config.yaml"
},
{
"tags": [
"product"
],
"url": "https://github.com/aaPanel/BillionMail"
},
{
"name": "VulnCheck Advisory: BillionMail through 4.9 Forgeable JWTs via Default Signing Key",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/billionmail-through-4.9-forgeable-jwts-via-default-signing-key"
}
],
"title": "BillionMail through 4.9 Forgeable JWTs via Default Signing Key",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111367",
"datePublished": "2026-10-15T21:43:50.886Z",
"dateReserved": "2026-10-15T21:21:22.403Z",
"dateUpdated": "2026-10-21T01:53:10.056Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107177 (GCVE-0-2026-107177)
Vulnerability from cvelistv5 – Published: 2026-10-07 12:48 – Updated: 2026-10-07 17:31 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens
Summary
Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 17:27 UTC
CWE
- CWE-1394 - Use of Default Cryptographic Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ExpressGateway/express-gateway… | issue-tracking |
| https://github.com/ExpressGateway/express-gateway | product |
| https://github.com/ExpressGateway/express-gateway… | technical-description |
| https://github.com/ExpressGateway/express-gateway… | technical-description |
| https://www.vulncheck.com/advisories/express-gate… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ExpressGateway | express-gateway |
Affected:
0 , ≤ 1.16.11
(semver)
cpe:2.3:a:express-gateway:express-gateway_docker_image:*:*:*:*:*:*:*:* |
Date Public
2026-10-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107177",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T17:27:31.854378Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:31:24.974Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ExpressGateway/express-gateway/issues/1078"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/express-gateway",
"product": "express-gateway",
"vendor": "ExpressGateway",
"versions": [
{
"lessThanOrEqual": "1.16.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:express-gateway:express-gateway_docker_image:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.16.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "MD Mahmidul Hasan"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey \u0027sensitiveKey\u0027. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1394",
"description": "Use of Default Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T12:48:19.043Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1078",
"tags": [
"issue-tracking"
],
"url": "https://github.com/ExpressGateway/express-gateway/issues/1078"
},
{
"tags": [
"product"
],
"url": "https://github.com/ExpressGateway/express-gateway"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/config/system.config.yml#L15-L22"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/services/utils.js#L18-L28"
},
{
"name": "VulnCheck Advisory: Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/express-gateway-through-1.16.11-hardcoded-default-cipherkey-exposes-oauth-tokens"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107177",
"datePublished": "2026-10-07T12:48:19.043Z",
"dateReserved": "2026-10-07T12:40:26.059Z",
"dateUpdated": "2026-10-07T17:31:24.974Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92777 (GCVE-0-2026-92777)
Vulnerability from cvelistv5 – Published: 2026-10-15 23:18 – Updated: 2026-10-16 16:30
VLAI
EPSS
VEX
Summary
A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:30 UTC
CWE
- CWE-1394 - Use of Default Cryptographic Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.lenovo.com/us/en/product_security… | vendor-advisory |
Impacted products
27 products
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Idea Tab Pro (TB373FU) |
Affected:
0 , < 17.5.10.057
(custom)
cpe:2.3:a:lenovo:idea_tab_pro_tb373fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU) |
Affected:
0 , < 17.5.10.193
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU) |
Affected:
0 , < 17.5.10.213
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_tb336zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU) |
Affected:
0 , < 17.5.10.210
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Legion Tab (8.8", 3) (TB321FU) |
Affected:
0 , < 17.5.10.170
(custom)
cpe:2.3:a:lenovo:legion_tab_8.8_3_tb321fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M11 (TB330FU) |
Affected:
0 , < 17.0.135
(custom)
cpe:2.3:a:lenovo:tab_m11_tb330fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M11 (TB330XU) |
Affected:
0 , < 17.0.517
(custom)
cpe:2.3:a:lenovo:tab_m11_tb330xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Extreme (TB570FU) |
Affected:
0 , < 17.5.382
(custom)
cpe:2.3:a:lenovo:tab_extreme_tb570fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Extreme (TB570ZU/TB570FU) |
Affected:
0 , < 17.5.382
(custom)
cpe:2.3:a:lenovo:tab_extreme_tb570zu_tb570fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 (TB330FUP) |
Affected:
0 , < 17.0.135
(custom)
cpe:2.3:a:lenovo:tab_k11_tb330fup_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 (TB330XUP) |
Affected:
0 , < 17.0.157
(custom)
cpe:2.3:a:lenovo:tab_k11_tb330xup_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus (TB352FU) |
Affected:
0 , < 17.0.10.296
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_tb352fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus (TB352XU) |
Affected:
0 , < 17.0.10.284
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_tb352xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus LTE ROW (TB352XU) |
Affected:
0 , < 17.0.10.284
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_lte_row_tb352xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus WIFI ROW: TB352FU |
Affected:
0 , < 17.0.10.296
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_wifi_row_tb352fu:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M10 5G (TB360ZU) |
Affected:
0 , < 16.0.935
(custom)
cpe:2.3:a:lenovo:tab_m10_5g_tb360zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K9 (TB305FU) |
Affected:
0 , < 17.0.10.216
(custom)
cpe:2.3:a:lenovo:tab_k9_tb305fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K9 (TB305XU) |
Affected:
0 , < 17.0.10.129
(custom)
cpe:2.3:a:lenovo:tab_k9_tb305xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab One (TB305FU) |
Affected:
0 , < 17.0.10.216
(custom)
cpe:2.3:a:lenovo:tab_one_tb305fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab One (TB305XU) |
Affected:
0 , < 17.0.10.129
(custom)
cpe:2.3:a:lenovo:tab_one_tb305xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab P12 (TB370FU) |
Affected:
0 , < 17.0.280
(custom)
cpe:2.3:a:lenovo:tab_p12_tb370fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Plus (TB351FU) |
Affected:
0 , < 17.5.10.199
(custom)
cpe:2.3:a:lenovo:tab_plus_tb351fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU) |
Affected:
0 , < 17.5.36.302
(custom)
cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU) |
Affected:
0 , < 17.5.36.302
(custom)
cpe:2.3:a:lenovo:lenovo_tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_tb311xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU) |
Affected:
0 , < 17.5.37.216
(custom)
cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Yoga Tab (TB710FU) |
Affected:
0 , < 17.5.04.059
(custom)
cpe:2.3:a:lenovo:yoga_tab_tb710fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Yoga Tab Plus (TB520FU) |
Affected:
0 , < 17.5.10.309
(custom)
cpe:2.3:a:lenovo:yoga_tab_plus_tb520fu_:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92777",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:30:32.813048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:30:52.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Idea Tab Pro (TB373FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.057",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.193",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.213",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.210",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Legion Tab (8.8\", 3) (TB321FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.170",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M11 (TB330FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.135",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M11 (TB330XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.517",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Extreme (TB570FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.382",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Extreme (TB570ZU/TB570FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.382",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 (TB330FUP)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.135",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 (TB330XUP)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.157",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus (TB352FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.296",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus (TB352XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.284",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus LTE ROW (TB352XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.284",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus WIFI ROW: TB352FU",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.296",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M10 5G (TB360ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "16.0.935",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K9 (TB305FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.216",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K9 (TB305XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.129",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab One (TB305FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.216",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab One (TB305XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.129",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab P12 (TB370FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.280",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Plus (TB351FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.199",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.36.302",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.36.302",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.37.216",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Yoga Tab (TB710FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.04.059",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Yoga Tab Plus (TB520FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.309",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_pro_tb373fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.057",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.193",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_tb336zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.213",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.210",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:legion_tab_8.8_3_tb321fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.170",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m11_tb330fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.135",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m11_tb330xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.517",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_extreme_tb570fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.382",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_extreme_tb570zu_tb570fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.382",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_tb330fup_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.135",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_tb330xup_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.157",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_tb352fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.296",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_tb352xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.284",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_lte_row_tb352xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.284",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_wifi_row_tb352fu:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.296",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m10_5g_tb360zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.0.935",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k9_tb305fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.216",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k9_tb305xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.129",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_one_tb305fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.216",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_one_tb305xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.129",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_p12_tb370fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.280",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_plus_tb351fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.199",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.36.302",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:lenovo_tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_tb311xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.36.302",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.37.216",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:yoga_tab_tb710fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.04.059",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:yoga_tab_plus_tb520fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.309",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks Masayoshi Matsubara for reporting this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code."
}
],
"value": "A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "PHYSICAL",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1394",
"description": "CWE-1394: Use of Default Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T23:18:01.762Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.lenovo.com/us/en/product_security/LEN-221035"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the version (or newer) indicated for your model in the advisory -\u0026nbsp;https://support.lenovo.com/us/en/product_security/LEN-221035"
}
],
"value": "Update to the version (or newer) indicated for your model in the advisory -\u00a0https://support.lenovo.com/us/en/product_security/LEN-221035"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-92777",
"datePublished": "2026-10-15T23:18:01.762Z",
"dateReserved": "2026-09-16T19:20:40.312Z",
"dateUpdated": "2026-10-16T16:30:52.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85295 (GCVE-0-2026-85295)
Vulnerability from cvelistv5 – Published: 2026-11-06 21:05 – Updated: 2026-11-06 21:05
VLAI
EPSS
VEX
Title
Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET
Summary
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, four authentication helpers accepted session tokens signed with CB_SECRET, including known, weak, or shipped-default values. The vulnerable surface is session JWT fallback in server/modules/verifyToken.js, verifyUser.js, getUserFromToken.js, and socketManager.js across the API and socket layer. A stock source or repository Docker Compose deployment retains a known, weak, or default CB_SECRET and an attacker submits a forged HS256 token decoding to a target user id. Knowing the symmetric secret lets the attacker create a token that the legacy verification fallback accepts as the target user without that user's password or two-factor authentication. The condition includes stock source and repository Docker Compose installs and any otherwise known or weak CB_SECRET; a bare container where CB_SECRET is undefined is not affected by this fallback path. A forged session impersonates the chosen user across the entire API and socket layer and exercises that user's Chartbrew privileges. This issue is fixed in version 5.2.3.
Severity
9.8 (Critical)
CWE
- CWE-1394 - Use of Default Cryptographic Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/chartbrew/chartbrew/security/a… | x_refsource_CONFIRM |
| https://github.com/chartbrew/chartbrew/commit/da8… | x_refsource_MISC |
| https://github.com/chartbrew/chartbrew/releases/t… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "chartbrew",
"vendor": "chartbrew",
"versions": [
{
"status": "affected",
"version": "\u003c 5.2.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, four authentication helpers accepted session tokens signed with CB_SECRET, including known, weak, or shipped-default values. The vulnerable surface is session JWT fallback in server/modules/verifyToken.js, verifyUser.js, getUserFromToken.js, and socketManager.js across the API and socket layer. A stock source or repository Docker Compose deployment retains a known, weak, or default CB_SECRET and an attacker submits a forged HS256 token decoding to a target user id. Knowing the symmetric secret lets the attacker create a token that the legacy verification fallback accepts as the target user without that user\u0027s password or two-factor authentication. The condition includes stock source and repository Docker Compose installs and any otherwise known or weak CB_SECRET; a bare container where CB_SECRET is undefined is not affected by this fallback path. A forged session impersonates the chosen user across the entire API and socket layer and exercises that user\u0027s Chartbrew privileges. This issue is fixed in version 5.2.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1394",
"description": "CWE-1394: Use of Default Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T21:05:31.286Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/chartbrew/chartbrew/security/advisories/GHSA-qvv4-r3q6-8797",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/chartbrew/chartbrew/security/advisories/GHSA-qvv4-r3q6-8797"
},
{
"name": "https://github.com/chartbrew/chartbrew/commit/da8c71f156aaa13fbc7ead15a4726740fef2b3c5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/chartbrew/chartbrew/commit/da8c71f156aaa13fbc7ead15a4726740fef2b3c5"
},
{
"name": "https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3"
}
],
"source": {
"advisory": "GHSA-qvv4-r3q6-8797",
"discovery": "UNKNOWN"
},
"title": "Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85295",
"datePublished": "2026-11-06T21:05:31.286Z",
"dateReserved": "2026-09-03T16:37:49.262Z",
"dateUpdated": "2026-11-06T21:05:31.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75870 (GCVE-0-2026-75870)
Vulnerability from cvelistv5 – Published: 2026-08-22 13:35 – Updated: 2026-08-25 19:28
VLAI
EPSS
VEX
Title
Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret
Summary
Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret.
The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key.
An attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 19:27 UTC
CWE
- CWE-1394 - Use of Default Cryptographic Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://metacpan.org/release/LNATION/Punk-0.17/so… | technical-description |
| https://metacpan.org/release/LNATION/Punk-0.17/vi… | technical-description |
| https://metacpan.org/release/LNATION/Punk-0.18/so… | release-notes |
| http://www.openwall.com/lists/oss-security/2026/08/22/5 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-08-22T19:07:10.053Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/22/5"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-75870",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T19:27:34.454527Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T19:28:36.443Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Punk"
],
"packageName": "Punk",
"packageURL": "pkg:cpan/Punk",
"programFiles": [
"xs/app.xs",
"include/punk/punk_session.h"
],
"programRoutines": [
{
"name": "Punk::App::session"
},
{
"name": "ps_load"
},
{
"name": "ps_writeback"
}
],
"versions": [
{
"lessThan": "0.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret.\n\nThe session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie read and the write-back both default that key to the empty string, so a declaration with no secret option, or with an undefined or empty one, signs and verifies with a zero-length HMAC-SHA256 key.\n\nAn attacker who knows the cookie format can then mint one offline carrying any contents the session holds, such as a user identifier or a role. Nothing marks the misconfiguration at runtime: cookies are well formed and sessions round-trip as expected."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1394",
"description": "CWE-1394 Use of Default Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T13:35:58.346Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://metacpan.org/release/LNATION/Punk-0.17/source/include/punk/punk_session.h"
},
{
"tags": [
"technical-description"
],
"url": "https://metacpan.org/release/LNATION/Punk-0.17/view/lib/Punk.pm"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/LNATION/Punk-0.18/source/Changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Punk 0.18 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret",
"workarounds": [
{
"lang": "en",
"value": "For deployments that cannot upgrade to 0.18, declare the session keyword with a non-empty secret. The secret keyword fails closed, so sourcing the key through it turns a missing configuration path or an unset environment variable into a startup error."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-75870",
"datePublished": "2026-08-22T13:35:58.346Z",
"dateReserved": "2026-08-18T11:59:49.642Z",
"dateUpdated": "2026-08-25T19:28:36.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72895 (GCVE-0-2026-72895)
Vulnerability from cvelistv5 – Published: 2026-10-13 09:18 – Updated: 2026-10-14 19:31
VLAI
EPSS
VEX
Summary
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 19:30 UTC
CWE
- CWE-1394 - Use of Default Cryptographic Key
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Siemens | SIMATIC IPC BX-21A |
Affected:
0 , < V31.01.13
(custom)
|
|
| Siemens | SIMATIC IPC RW-543A |
Affected:
0 , < V1.1.4
(custom)
|
|
| Siemens | SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G |
Affected:
0 , < V28.01.15
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72895",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T19:30:58.171008Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T19:31:07.576Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC IPC BX-21A",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V31.01.13",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC IPC RW-543A",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V1.1.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V28.01.15",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in SIMATIC IPC BX-21A (All versions \u003c V31.01.13), SIMATIC IPC RW-543A (All versions \u003c V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions \u003c V28.01.15). A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1394",
"description": "CWE-1394: Use of Default Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T09:18:54.197Z",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-159454.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2026-72895",
"datePublished": "2026-10-13T09:18:54.197Z",
"dateReserved": "2026-08-10T16:56:32.491Z",
"dateUpdated": "2026-10-14T19:31:07.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54887 (GCVE-0-2026-54887)
Vulnerability from cvelistv5 – Published: 2026-07-02 16:06 – Updated: 2026-07-24 14:15
VLAI
EPSS
VEX
Title
DTLS server cookie bypass during startup window due to empty initial cookie secret
Summary
Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass.
On DTLS server startup, dtls_server_connection:initial_hello/3 initializes previous_cookie_secret to the empty binary (<<>>) instead of a random value. Because HMAC with an empty key is deterministic, anyone who observes the plaintext ClientHello can compute dtls_handshake:cookie(<<>>, IP, Port, Hello) and forge a valid DTLS cookie before the first rotation of the cookie secret. The DTLS cookie (RFC 6347 §4.2.1) is a denial-of-service mitigation that prevents spoofed source IPs from forcing the server to allocate state and perform expensive cryptographic operations; it is not an authentication mechanism. During the window from server startup until the first secret rotation (0 to 15 seconds), an attacker who can observe the plaintext ClientHello can bypass the source address verification, enabling DTLS handshake amplification with spoofed source addresses.
This vulnerability is associated with program file lib/ssl/src/dtls_server_connection.erl and program routine dtls_server_connection:initial_hello/3.
This issue affects OTP from OTP 20.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssl from 8.2 before 11.7.3, 11.6.0.3 and 11.2.12.10.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-02 17:28 UTC
CWE
- CWE-1394 - Use of Default Cryptographic Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/erlang/otp/security/advisories… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-54887.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-54887 | related |
| https://www.erlang.org/doc/system/versions.html#o… | x_version-scheme |
| https://github.com/erlang/otp/commit/888e3bcd72d5… | patch |
Impacted products
2 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54887",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-02T17:28:36.936306Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-02T17:28:43.784Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"dtls_server_connection"
],
"packageName": "ssl",
"packageURL": "pkg:otp/ssl?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
"product": "OTP",
"programFiles": [
"src/dtls_server_connection.erl"
],
"programRoutines": [
{
"name": "dtls_server_connection:initial_hello/3"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "11.7.3",
"status": "unaffected"
},
{
"at": "11.6.0.3",
"status": "unaffected"
},
{
"at": "11.2.12.10",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "8.2",
"versionType": "otp"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"dtls_server_connection"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"product": "OTP",
"programFiles": [
"lib/ssl/src/dtls_server_connection.erl"
],
"programRoutines": [
{
"name": "dtls_server_connection:initial_hello/3"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "29.0.3",
"status": "unaffected"
},
{
"at": "28.5.0.3",
"status": "unaffected"
},
{
"at": "27.3.4.14",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "20.0",
"versionType": "otp"
},
{
"lessThan": "888e3bcd72d5406016b9e0de741026bc2a6f114d",
"status": "affected",
"version": "e594aad2f87aab39e99fccf9e021bc94e0bbf7d4",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "27.3.4.14",
"versionStartIncluding": "20.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "28.5.0.3",
"versionStartIncluding": "28.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "29.0.3",
"versionStartIncluding": "29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lukas Backstr\u00f6m"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ingela Anderton Andin"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Dan Gudmundsson"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUse of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass.\u003c/p\u003e\u003cp\u003eOn DTLS server startup, \u003ctt\u003edtls_server_connection:initial_hello/3\u003c/tt\u003e initializes \u003ctt\u003eprevious_cookie_secret\u003c/tt\u003e to the empty binary (\u003ctt\u003e\u0026lt;\u0026lt;\u0026gt;\u0026gt;\u003c/tt\u003e) instead of a random value. Because HMAC with an empty key is deterministic, anyone who observes the plaintext \u003ctt\u003eClientHello\u003c/tt\u003e can compute \u003ctt\u003edtls_handshake:cookie(\u0026lt;\u0026lt;\u0026gt;\u0026gt;, IP, Port, Hello)\u003c/tt\u003e and forge a valid DTLS cookie before the first rotation of the cookie secret. The DTLS cookie (RFC 6347 \u00a74.2.1) is a denial-of-service mitigation that prevents spoofed source IPs from forcing the server to allocate state and perform expensive cryptographic operations; it is not an authentication mechanism. During the window from server startup until the first secret rotation (0 to 15 seconds), an attacker who can observe the plaintext \u003ctt\u003eClientHello\u003c/tt\u003e can bypass the source address verification, enabling DTLS handshake amplification with spoofed source addresses.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program file \u003ctt\u003elib/ssl/src/dtls_server_connection.erl\u003c/tt\u003e and program routine \u003ctt\u003edtls_server_connection:initial_hello/3\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects OTP from OTP 20.0 before OTP\u0026nbsp;29.0.3, OTP\u0026nbsp;28.5.0.3 and OTP\u0026nbsp;27.3.4.14, corresponding to ssl from 8.2 before 11.7.3, 11.6.0.3 and 11.2.12.10.\u003c/p\u003e"
}
],
"value": "Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass.\n\nOn DTLS server startup, dtls_server_connection:initial_hello/3 initializes previous_cookie_secret to the empty binary (\u003c\u003c\u003e\u003e) instead of a random value. Because HMAC with an empty key is deterministic, anyone who observes the plaintext ClientHello can compute dtls_handshake:cookie(\u003c\u003c\u003e\u003e, IP, Port, Hello) and forge a valid DTLS cookie before the first rotation of the cookie secret. The DTLS cookie (RFC 6347 \u00a74.2.1) is a denial-of-service mitigation that prevents spoofed source IPs from forcing the server to allocate state and perform expensive cryptographic operations; it is not an authentication mechanism. During the window from server startup until the first secret rotation (0 to 15 seconds), an attacker who can observe the plaintext ClientHello can bypass the source address verification, enabling DTLS handshake amplification with spoofed source addresses.\n\nThis vulnerability is associated with program file lib/ssl/src/dtls_server_connection.erl and program routine dtls_server_connection:initial_hello/3.\n\nThis issue affects OTP from OTP 20.0 before OTP\u00a029.0.3, OTP\u00a028.5.0.3 and OTP\u00a027.3.4.14, corresponding to ssl from 8.2 before 11.7.3, 11.6.0.3 and 11.2.12.10."
}
],
"impacts": [
{
"capecId": "CAPEC-485",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-485 Signature Spoofing by Key Recreation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1394",
"description": "CWE-1394 Use of Default Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:15:16.337Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/erlang/otp/security/advisories/GHSA-p2m2-3c2w-8jp8"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-54887.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-54887"
},
{
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/888e3bcd72d5406016b9e0de741026bc2a6f114d"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "DTLS server cookie bypass during startup window due to empty initial cookie secret",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-54887",
"datePublished": "2026-07-02T16:06:04.156Z",
"dateReserved": "2026-06-16T10:47:13.915Z",
"dateUpdated": "2026-07-24T14:15:16.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Requirements
Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
Mitigation
Architecture and Design
Force the administrator to change the credential upon installation.
Mitigation
Installation
Operation
The product administrator could change the defaults upon installation or during operation.
No CAPEC attack patterns related to this CWE.