Common Weakness Enumeration
CWE-321
AllowedUse of Hard-coded Cryptographic Key
Abstraction: Variant · Status: Draft
The product uses a hard-coded, unchangeable cryptographic key.
710 vulnerabilities reference this CWE, most recent first.
GCVE-1337-2026-000000000… (CVE-2026-105035)
Vulnerability from gna-1337 – Published: 2026-10-15 20:42 – Updated: 2026-10-15 20:42
VLAI
EPSS
VEX
Title
EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key
Summary
The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.
Severity
7.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CNA · AHA (v2.0.3)
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
References
3 references
| URL | Tags |
|---|---|
| https://github.com/xn0tsa/your-secrets-are-safe-with-me | technical-description |
| https://takeonme.org/gcves/GCVE-1337-2026-0000000… | third-party-advisory |
| https://www.theverge.com/tech/1010727/eiliko-robo… | media-coverage |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| EnergizeLab | FirmwareUpdater |
Affected:
n/a
|
Date Public
2026-10-15 12:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FirmwareUpdater",
"vendor": "EnergizeLab",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sammy Azdoufal"
},
{
"lang": "en",
"type": "coordinator",
"value": "todb of AHA!"
}
],
"datePublic": "2026-10-15T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it."
}
],
"value": "The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"other": {
"content": {
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CNA",
"version": "2.0.3"
},
"type": "ssvc"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321 Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T20:42:53.222Z",
"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"shortName": "AHA"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/xn0tsa/your-secrets-are-safe-with-me"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111100111111111000000000000000000011111111111111100000000000000000001111/"
},
{
"tags": [
"media-coverage"
],
"url": "https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key",
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "gcve-1337-2026-00000000000000000001111111111100000000000000000000000011111111100111111111000000000000000000011111111111111100000000000000000001111"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"assignerShortName": "AHA",
"cveId": "CVE-2026-105035",
"datePublished": "2026-10-15T20:42:53.222Z",
"dateReserved": "2026-10-02T21:30:55.242Z",
"dateUpdated": "2026-10-15T20:42:53.222Z",
"serial": 1,
"state": "PUBLISHED",
"vulnId": "GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111100111111111000000000000000000011111111111111100000000000000000001111"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117564 (GCVE-0-2026-117564)
Vulnerability from cvelistv5 – Published: 2026-10-27 13:07 – Updated: 2026-10-28 16:16
VLAI
EPSS
VEX
Title
nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret
Summary
nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 15:56 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/buqiyuan/nest-admin/issues/93 | issue-tracking |
| https://github.com/buqiyuan/nest-admin | product |
| https://github.com/buqiyuan/nest-admin/commit/f2c… | patch |
| https://github.com/buqiyuan/nest-admin/issues/92 | issue-tracking |
| https://github.com/buqiyuan/nest-admin/blob/2eecc… | technical-description |
| https://www.vulncheck.com/advisories/nest-admin-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| buqiyuan | nest-admin |
Affected:
0 , < 1.0.1
(semver)
|
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-117564",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T15:56:42.754470Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:16:56.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "nest-admin",
"vendor": "buqiyuan",
"versions": [
{
"lessThan": "1.0.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T13:07:58.360Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #93",
"tags": [
"issue-tracking"
],
"url": "https://github.com/buqiyuan/nest-admin/issues/93"
},
{
"tags": [
"product"
],
"url": "https://github.com/buqiyuan/nest-admin"
},
{
"tags": [
"patch"
],
"url": "https://github.com/buqiyuan/nest-admin/commit/f2cec8cb776cbf113115b33164dac69a46d24097"
},
{
"name": "GitHub Issue #92",
"tags": [
"issue-tracking"
],
"url": "https://github.com/buqiyuan/nest-admin/issues/92"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/buqiyuan/nest-admin/blob/2eeccc4cb699d1aedbe04b4437a9d095cde02c74/.env.production#L5"
},
{
"name": "VulnCheck Advisory: nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nest-admin-before-1.0.1-authentication-bypass-via-hardcoded-jwt-secret"
}
],
"title": "nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-117564",
"datePublished": "2026-10-27T13:07:58.360Z",
"dateReserved": "2026-10-27T11:25:24.150Z",
"dateUpdated": "2026-10-28T16:16:56.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116747 (GCVE-0-2026-116747)
Vulnerability from cvelistv5 – Published: 2026-10-26 21:52 – Updated: 2026-10-26 21:52
VLAI
EPSS
VEX
Title
Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret
Summary
Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens.
Severity
8.1 (High)
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/rajnandan1/kener/issues/871 | issue-tracking |
| https://github.com/rajnandan1/kener | product |
| https://github.com/rajnandan1/kener/commit/ff6364… | patch |
| https://github.com/rajnandan1/kener/releases/tag/… | release-notes |
| https://github.com/rajnandan1/kener/blob/v4.1.9/s… | technical-description |
| https://www.vulncheck.com/advisories/kener-3.0.0-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rajnandan1 | kener |
Affected:
3.0.0 , < 4.1.10
(semver)
|
Date Public
2026-10-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/rajnandan1/kener",
"product": "kener",
"repo": "https://github.com/rajnandan1/kener",
"vendor": "rajnandan1",
"versions": [
{
"lessThan": "4.1.10",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie to access /manage/api with full administrative privileges or forge password-reset tokens."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T21:52:45.058Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #871",
"tags": [
"issue-tracking"
],
"url": "https://github.com/rajnandan1/kener/issues/871"
},
{
"tags": [
"product"
],
"url": "https://github.com/rajnandan1/kener"
},
{
"tags": [
"patch"
],
"url": "https://github.com/rajnandan1/kener/commit/ff636483544c926eab5b5e3e26b811c0f52bcaf8"
},
{
"name": "kener v4.1.10 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/rajnandan1/kener/releases/tag/v4.1.10"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/rajnandan1/kener/blob/v4.1.9/src/lib/server/controllers/commonController.ts#L44-L55"
},
{
"name": "VulnCheck Advisory: Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kener-3.0.0-before-4.1.10-authentication-bypass-via-hardcoded-fallback-jwt-secret"
}
],
"title": "Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116747",
"datePublished": "2026-10-26T21:52:45.058Z",
"dateReserved": "2026-10-26T20:23:37.323Z",
"dateUpdated": "2026-10-26T21:52:45.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113466 (GCVE-0-2026-113466)
Vulnerability from cvelistv5 – Published: 2026-10-20 14:45 – Updated: 2026-10-20 15:31 Unsupported When Assigned
VLAI
EPSS
VEX
Title
MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key
Summary
A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key
. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:30 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422691 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422691/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113466 | third-party-advisory |
| https://vuldb.com/submit/1004925 | third-party-advisory |
| https://github.com/zast-ai/vulnerability-reports/… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113466",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:30:24.330809Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:31:34.898Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*"
],
"modules": [
"Embedded Console"
],
"product": "MinIO",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "RELEASE.2025-10-15T17-29-55Z"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ZAST.AI (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key\r . It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-320",
"description": "Key Management Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T14:45:12.542Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422691 | MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422691"
},
{
"name": "VDB-422691 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422691/cti"
},
{
"name": "CVE-2026-113466 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113466"
},
{
"name": "Submit #1004925 | MinIO \u003c=RELEASE.2025-10-15T17-29-55Z Use of Hard-coded Cryptographic Key",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1004925"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/zast-ai/vulnerability-reports/blob/main/minio/unauth_admin_takeover.md"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T10:08:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113466",
"datePublished": "2026-10-20T14:45:12.542Z",
"dateReserved": "2026-10-20T08:03:43.471Z",
"dateUpdated": "2026-10-20T15:31:34.898Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112345 (GCVE-0-2026-112345)
Vulnerability from cvelistv5 – Published: 2026-10-26 14:43 – Updated: 2026-10-27 10:14
VLAI
EPSS
VEX
Title
TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure
Summary
TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 16:06 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://damiri.fr/en/cve/CVE-2026-112345 | technical-descriptionexploit |
| https://www.vulncheck.com/advisories/ttlock-andro… | third-party-advisory |
Impacted products
Date Public
2026-10-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112345",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T16:06:18.962111Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T16:15:26.221Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TTLock",
"vendor": "Sciener",
"versions": [
{
"lessThan": "9.8.260718",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ttlock:ttlock:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.8.260718",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yassine Damiri"
}
],
"datePublic": "2026-10-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T10:14:05.557Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://damiri.fr/en/cve/CVE-2026-112345"
},
{
"name": "VulnCheck Advisory: TTLock Android App \u003c 9.8.260718 Hardcoded BLE Pairing Key Exposure",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ttlock-android-app-hardcoded-ble-pairing-key-exposure"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "TTLock Android App \u003c 9.8.260718 Hardcoded BLE Pairing Key Exposure",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112345",
"datePublished": "2026-10-26T14:43:29.943Z",
"dateReserved": "2026-10-19T14:41:46.702Z",
"dateUpdated": "2026-10-27T10:14:05.557Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112014 (GCVE-0-2026-112014)
Vulnerability from cvelistv5 – Published: 2026-10-18 11:38 – Updated: 2026-10-20 15:12
VLAI
EPSS
VEX
Title
LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export
Summary
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI provider API key.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:12 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/netease-youdao/LobsterAI/issues/2851 | issue-tracking |
| https://github.com/netease-youdao/LobsterAI/blob/… | technical-description |
| https://github.com/netease-youdao/LobsterAI/blob/… | technical-description |
| https://github.com/netease-youdao/LobsterAI/commi… | patch |
| https://github.com/netease-youdao/LobsterAI/relea… | release-notes |
| https://www.vulncheck.com/advisories/lobsterai-be… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| netease-youdao | LobsterAI |
Affected:
0 , < 2026.10.16
(custom)
|
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112014",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:12:41.505436Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:12:51.711Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/netease-youdao/LobsterAI",
"product": "LobsterAI",
"repo": "https://github.com/netease-youdao/LobsterAI",
"vendor": "netease-youdao",
"versions": [
{
"lessThan": "2026.10.16",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant \u0027lobsterai-APP\u0027. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI provider API key."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:38:35.397Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/netease-youdao/LobsterAI/issues/2851"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/netease-youdao/LobsterAI/blob/2026.9.23/src/renderer/constants/app.ts#L4"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/netease-youdao/LobsterAI/blob/2026.9.23/src/renderer/components/Settings.tsx#L4324-L4331"
},
{
"tags": [
"patch"
],
"url": "https://github.com/netease-youdao/LobsterAI/commit/1eb28c40d7e42d6cbade07874e6f6c068b6a9a64"
},
{
"name": "LobsterAI 2026.10.16 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/netease-youdao/LobsterAI/releases/tag/2026.10.16"
},
{
"name": "VulnCheck Advisory: LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lobsterai-before-2026.10.16-hardcoded-password-in-provider-api-key-export"
}
],
"title": "LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112014",
"datePublished": "2026-10-18T11:38:35.397Z",
"dateReserved": "2026-10-18T01:23:59.312Z",
"dateUpdated": "2026-10-20T15:12:51.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111696 (GCVE-0-2026-111696)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-16 21:17
VLAI
EPSS
VEX
Title
data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords
Summary
data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:34 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/data-platform-op… | third-party-advisory |
| https://github.com/shaiwz/data-platform-open/blob… | technical-description |
| https://github.com/shaiwz/data-platform-open/blob… | technical-description |
| https://www.vulncheck.com/advisories/data-platfor… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| shaiwz | data-platform-open |
Affected:
0 , ≤ efeacd35e8450b7a084fa2134d292cd058cf605b
(git)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111696",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:34:13.790940Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T21:17:09.657Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/shaiwz/data-platform-open",
"product": "data-platform-open",
"repo": "https://github.com/shaiwz/data-platform-open",
"vendor": "shaiwz",
"versions": [
{
"lessThanOrEqual": "efeacd35e8450b7a084fa2134d292cd058cf605b",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and decrypt them offline to recover plaintext database credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:39:50.964Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/data-platform-open-datasource-cross-workspace-idor-and-hardcoded-aes-key"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/shaiwz/data-platform-open/blob/efeacd35e8450b7a084fa2134d292cd058cf605b/data-platform-open-web/src/main/java/cn/dataplatform/open/web/service/impl/AesPasswordEncAndDecServiceImpl.java#L21-L25"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/shaiwz/data-platform-open/blob/efeacd35e8450b7a084fa2134d292cd058cf605b/data-platform-open-common/src/main/resources/application-common.yml#L104-L106"
},
{
"name": "VulnCheck Advisory: data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/data-platform-open-through-commit-efeacd3-hardcoded-aes-key-for-datasource-passwords"
}
],
"title": "data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111696",
"datePublished": "2026-10-16T17:39:50.964Z",
"dateReserved": "2026-10-16T14:31:21.138Z",
"dateUpdated": "2026-10-16T21:17:09.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111692 (GCVE-0-2026-111692)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-16 19:06
VLAI
EPSS
VEX
Title
DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret
Summary
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:06 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/databuff-default… | third-party-advisory |
| https://github.com/databufflabs/databuff/blob/v0.… | technical-description |
| https://github.com/databufflabs/databuff/blob/v0.… | technical-description |
| https://github.com/databufflabs/databuff/blob/v0.… | technical-description |
| https://github.com/databufflabs/databuff | product |
| https://www.vulncheck.com/advisories/databuff-ai-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| databufflabs | databuff |
Affected:
0 , ≤ 0.1.10
(custom)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111692",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:06:19.195700Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:06:45.355Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/databuff-default-jwt-secret-auth-bypass"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/databufflabs/databuff",
"product": "databuff",
"repo": "https://github.com/databufflabs/databuff",
"vendor": "databufflabs",
"versions": [
{
"lessThanOrEqual": "0.1.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:39:48.239Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/databuff-default-jwt-secret-auth-bypass"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/resources/application.yml#L54-L59"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/java/com/databuff/apm/web/config/JwtProperties.java#L8-L15"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/java/com/databuff/apm/web/auth/JwtTokenService.java#L36-L60"
},
{
"tags": [
"product"
],
"url": "https://github.com/databufflabs/databuff"
},
{
"name": "VulnCheck Advisory: DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/databuff-ai-apm-web-through-0.1.10-authentication-bypass-via-hardcoded-hmac-secret"
}
],
"title": "DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111692",
"datePublished": "2026-10-16T17:39:48.239Z",
"dateReserved": "2026-10-16T14:31:20.594Z",
"dateUpdated": "2026-10-16T19:06:45.355Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111690 (GCVE-0-2026-111690)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-19 13:35
VLAI
EPSS
VEX
Title
Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass
Summary
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 13:34 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/simple-admin-cor… | third-party-advisory |
| https://github.com/suyuan32/simple-admin-core/blo… | technical-description |
| https://github.com/suyuan32/simple-admin-core/pull/382 | issue-trackingpatch |
| https://www.vulncheck.com/advisories/simple-admin… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| suyuan32 | simple-admin-core |
Affected:
0 , ≤ 1.8.7
(custom)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111690",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T13:34:03.686528Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:35:10.955Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/simple-admin-core-hardcoded-jwt-accesssecret-admin-auth-bypass"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/suyuan32/simple-admin-core",
"product": "simple-admin-core",
"repo": "https://github.com/suyuan32/simple-admin-core",
"vendor": "suyuan32",
"versions": [
{
"lessThanOrEqual": "1.8.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:39:46.960Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/simple-admin-core-hardcoded-jwt-accesssecret-admin-auth-bypass"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/suyuan32/simple-admin-core/blob/v1.8.7/api/etc/core.yaml#L6-L8"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/suyuan32/simple-admin-core/pull/382"
},
{
"name": "VulnCheck Advisory: Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/simple-admin-core-through-1.8.7-hard-coded-jwt-secret-authentication-bypass"
}
],
"title": "Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111690",
"datePublished": "2026-10-16T17:39:46.960Z",
"dateReserved": "2026-10-16T14:31:20.316Z",
"dateUpdated": "2026-10-19T13:35:10.955Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111642 (GCVE-0-2026-111642)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-16 19:21
VLAI
EPSS
VEX
Title
FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation
Summary
FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their session_id but naming the superuser in user_name to gain superuser privileges.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:20 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/fastapiadmin-una… | third-party-advisory |
| https://github.com/fastapiadmin/FastapiAdmin/blob… | technical-description |
| https://github.com/fastapiadmin/FastapiAdmin/blob… | technical-description |
| https://www.vulncheck.com/advisories/fastapiadmin… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| fastapiadmin | FastapiAdmin |
Affected:
0 , ≤ 3.0
(custom)
cpe:2.3:a:fastapiadmin:fastapiadmin:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111642",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:20:27.537959Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:21:12.720Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/fastapiadmin-unauthenticated-autologin-and-hardcoded-jwt-secret"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/fastapiadmin/FastapiAdmin",
"product": "FastapiAdmin",
"repo": "https://github.com/fastapiadmin/FastapiAdmin",
"vendor": "fastapiadmin",
"versions": [
{
"lessThanOrEqual": "3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fastapiadmin:fastapiadmin:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their session_id but naming the superuser in user_name to gain superuser privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:39:12.365Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/fastapiadmin-unauthenticated-autologin-and-hardcoded-jwt-secret"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/fastapiadmin/FastapiAdmin/blob/v3.0/backend/app/config/setting.py#L67"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/fastapiadmin/FastapiAdmin/blob/v3.0/backend/app/core/dependencies.py#L72-L112"
},
{
"name": "VulnCheck Advisory: FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/fastapiadmin-through-3.0-hard-coded-jwt-secret-privilege-escalation"
}
],
"title": "FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111642",
"datePublished": "2026-10-16T17:39:12.365Z",
"dateReserved": "2026-10-16T14:31:13.728Z",
"dateUpdated": "2026-10-16T19:21:12.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Prevention schemes mirror that of hard-coded password storage.
No CAPEC attack patterns related to this CWE.