Common Weakness Enumeration
CWE-321
Weakness AllowedUse of Hard-coded Cryptographic Key
Abstraction: Variant · Status: Draft
The product uses a hard-coded, unchangeable cryptographic key.
Mapping guidance
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Relationships and members
Modes of introduction
Architecture and Design
REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Detection methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Notes
Other
The main difference between the use of hard-coded passwords and the use of hard-coded cryptographic keys is the false sense of security that the former conveys. Many people believe that simply hashing a hard-coded password before storage will protect the information from malicious users. However, many hashes are reversible (or at least vulnerable to brute force attacks) -- and further, many authentication protocols simply request the hash itself, making it no better than a password.
Content history
Submission: CLASP
· 2006-07-19
· CWE Draft 3
Contribution: "Mapping CWE to 62443" Sub-Working Group
· CWE-CAPEC ICS/OT SIG
· 2023-01-24
· CWE 4.10
Suggested mappings to ISA/IEC 62443.
Contribution: "Mapping CWE to 62443" Sub-Working Group
· CWE-CAPEC ICS/OT SIG
· 2023-04-25
· CWE 4.11
Suggested mappings to ISA/IEC 62443.
Modification: Eric Dalci
· Cigital
· 2008-07-01
· CWE 1.0
updated Time_of_Introduction
Modification:
· Veracode
· 2008-08-15
· CWE 1.0
Suggested OWASP Top Ten 2004 mapping
Modification: CWE Content Team
· MITRE
· 2008-09-08
· CWE 1.0
updated Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2009-05-27
· CWE 1.4
updated Demonstrative_Examples
Modification: CWE Content Team
· MITRE
· 2010-02-16
· CWE 1.8
updated Relationships
Modification: CWE Content Team
· MITRE
· 2010-09-27
· CWE 1.10
updated Relationships
Modification: CWE Content Team
· MITRE
· 2010-12-13
· CWE 1.11
updated Relationships
Modification: CWE Content Team
· MITRE
· 2011-06-01
· CWE 1.13
updated Common_Consequences
Modification: CWE Content Team
· MITRE
· 2012-05-11
· CWE 2.2
updated Demonstrative_Examples, Relationships
Modification: CWE Content Team
· MITRE
· 2014-07-30
· CWE 2.8
updated Demonstrative_Examples, Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2017-11-08
· CWE 3.0
updated Applicable_Platforms, Demonstrative_Examples, Modes_of_Introduction, Relationships
Modification: CWE Content Team
· MITRE
· 2020-02-24
· CWE 4.0
updated References, Relationships, Type
Modification: CWE Content Team
· MITRE
· 2020-08-20
· CWE 4.2
updated Relationships
Modification: CWE Content Team
· MITRE
· 2020-12-10
· CWE 4.3
updated Relationships
Modification: CWE Content Team
· MITRE
· 2021-10-28
· CWE 4.6
updated Relationships
Modification: CWE Content Team
· MITRE
· 2022-10-13
· CWE 4.9
updated Demonstrative_Examples, Observed_Examples, References
Modification: CWE Content Team
· MITRE
· 2023-01-31
· CWE 4.10
updated Applicable_Platforms, Maintenance_Notes, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated Detection_Factors, Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2025-04-03
· CWE 4.17
updated Common_Consequences, Description, Diagram
Modification: CWE Content Team
· MITRE
· 2025-12-11
· CWE 4.19
updated Maintenance_Notes, Relationships, Weakness_Ordinalities
Modification: CWE Content Team
· MITRE
· 2026-10-28
· CWE 5.0
updated Applicable_Platforms, Observed_Examples, References, Relationships, Taxonomy_Mappings
754 vulnerabilities reference this CWE, most recent first.
GCVE-1337-2026-000000000… (CVE-2026-105035)
Vulnerability from gna-1337 – Published: 2026-10-15 20:42 – Updated: 2026-10-15 20:42
VLAI
EPSS
VEX
Title
EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key
Summary
The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.
Severity
7.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CNA · AHA (v2.0.3)
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
References
3 references
| URL | Tags |
|---|---|
| https://github.com/xn0tsa/your-secrets-are-safe-with-me | technical-description |
| https://takeonme.org/gcves/GCVE-1337-2026-0000000… | third-party-advisory |
| https://www.theverge.com/tech/1010727/eiliko-robo… | media-coverage |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| EnergizeLab | FirmwareUpdater |
Affected:
n/a
|
Date Public
2026-10-15 12:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FirmwareUpdater",
"vendor": "EnergizeLab",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sammy Azdoufal"
},
{
"lang": "en",
"type": "coordinator",
"value": "todb of AHA!"
}
],
"datePublic": "2026-10-15T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it."
}
],
"value": "The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"other": {
"content": {
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CNA",
"version": "2.0.3"
},
"type": "ssvc"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321 Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T20:42:53.222Z",
"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"shortName": "AHA"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/xn0tsa/your-secrets-are-safe-with-me"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111100111111111000000000000000000011111111111111100000000000000000001111/"
},
{
"tags": [
"media-coverage"
],
"url": "https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key",
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "gcve-1337-2026-00000000000000000001111111111100000000000000000000000011111111100111111111000000000000000000011111111111111100000000000000000001111"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"assignerShortName": "AHA",
"cveId": "CVE-2026-105035",
"datePublished": "2026-10-15T20:42:53.222Z",
"dateReserved": "2026-10-02T21:30:55.242Z",
"dateUpdated": "2026-10-15T20:42:53.222Z",
"serial": 1,
"state": "PUBLISHED",
"vulnId": "GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111100111111111000000000000000000011111111111111100000000000000000001111"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126797 (GCVE-0-2026-126797)
Vulnerability from cvelistv5 – Published: 2026-11-11 20:53 – Updated: 2026-11-11 20:53
VLAI
EPSS
VEX
Title
NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin
Summary
NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results.
Severity
9.8 (Critical)
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/tongcheng-security-team/NextSc… | issue-tracking |
| https://github.com/tongcheng-security-team/NextSc… | product |
| https://hub.docker.com/r/lysec/ns-admin | product |
| https://vul.yulun.ac.cn/20261107/nextscan/ | third-party-advisory |
| https://www.vulncheck.com/advisories/nextscan-1.1… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tongcheng-security-team | NextScan |
Affected:
1.1.0 , ≤ 1.2.0
(semver)
|
Date Public
2026-11-07 02:20
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:docker/lysec/ns-admin",
"product": "NextScan",
"vendor": "tongcheng-security-team",
"versions": [
{
"lessThanOrEqual": "1.2.0",
"status": "affected",
"version": "1.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wu Yulun"
}
],
"datePublic": "2026-11-07T02:20:53.000Z",
"descriptions": [
{
"lang": "en",
"value": "NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T20:53:02.665Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/tongcheng-security-team/NextScan/issues/48"
},
{
"tags": [
"product"
],
"url": "https://github.com/tongcheng-security-team/NextScan/blob/v1.2.0/docker/docker-compose.yaml"
},
{
"tags": [
"product"
],
"url": "https://hub.docker.com/r/lysec/ns-admin"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://vul.yulun.ac.cn/20261107/nextscan/"
},
{
"name": "VulnCheck Advisory: NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-hardcoded-jwt-key-authentication-bypass-in-ns-admin"
}
],
"title": "NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126797",
"datePublished": "2026-11-11T20:53:02.665Z",
"dateReserved": "2026-11-11T20:01:46.748Z",
"dateUpdated": "2026-11-11T20:53:02.665Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125383 (GCVE-0-2026-125383)
Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-12 18:04
VLAI
EPSS
VEX
Title
INDOTALENT WHMS before 10.20261109 Hard-Coded JWT Signing Key Authentication Bypass
Summary
INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 16:53 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/go2ismail/Asp.Net-Core-Invento… | issue-tracking |
| https://github.com/go2ismail/Asp.Net-Core-Invento… | product |
| https://github.com/go2ismail/Asp.Net-Core-Invento… | technical-description |
| https://github.com/go2ismail/Asp.Net-Core-Invento… | patch |
| https://github.com/go2ismail/Asp.Net-Core-Invento… | patch |
| https://github.com/go2ismail/Asp.Net-Core-Invento… | release-notes |
| https://www.vulncheck.com/advisories/indotalent-w… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| go2ismail | Asp.Net-Core-Inventory-Order-Management-System |
Affected:
0 , < 10.20261109
(custom)
|
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125383",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T16:53:19.390308Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T18:04:12.109Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Asp.Net-Core-Inventory-Order-Management-System",
"vendor": "go2ismail",
"versions": [
{
"lessThan": "10.20261109",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T23:27:51.039Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #48",
"tags": [
"issue-tracking"
],
"url": "https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/issues/48"
},
{
"tags": [
"product"
],
"url": "https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/blob/v9.20250118/Presentation/ASPNET/appsettings.json#L38-L44"
},
{
"tags": [
"patch"
],
"url": "https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/65609b5b88cb4f156e8164f33b8db8c63f5c125b"
},
{
"tags": [
"patch"
],
"url": "https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/ded7d8a9457c780dfd4f5ea74d7e72111fafaea6"
},
{
"name": "Asp.Net-Core-Inventory-Order-Management-System v10.20261109 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/releases/tag/v10.20261109"
},
{
"name": "VulnCheck Advisory: INDOTALENT WHMS before 10.20261109 Hard-Coded JWT Signing Key Authentication Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/indotalent-whms-before-10.20261109-hard-coded-jwt-signing-key-authentication-bypass"
}
],
"title": "INDOTALENT WHMS before 10.20261109 Hard-Coded JWT Signing Key Authentication Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125383",
"datePublished": "2026-11-09T23:27:51.039Z",
"dateReserved": "2026-11-09T22:03:08.782Z",
"dateUpdated": "2026-11-12T18:04:12.109Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125370 (GCVE-0-2026-125370)
Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-13 13:52
VLAI
EPSS
VEX
Title
Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret
Summary
Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 13:51 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubero-dev/kubero/issues/786 | issue-tracking |
| https://github.com/kubero-dev/kubero | product |
| https://github.com/kubero-dev/kubero/blob/bcb5237… | technical-description |
| https://www.vulncheck.com/advisories/kubero-3.0.0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kubero-dev | kubero |
Affected:
3.0.0 , ≤ 3.1.1
(semver)
|
Date Public
2026-08-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125370",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T13:51:49.417374Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T13:52:37.225Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/kubero-dev/kubero/issues/786"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "kubero",
"vendor": "kubero-dev",
"versions": [
{
"lessThanOrEqual": "3.1.1",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Azizbek Tursunov (28Hus)"
}
],
"datePublic": "2026-08-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T11:53:11.145Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #786",
"tags": [
"issue-tracking"
],
"url": "https://github.com/kubero-dev/kubero/issues/786"
},
{
"tags": [
"product"
],
"url": "https://github.com/kubero-dev/kubero"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/kubero-dev/kubero/blob/bcb52376b19347b8c36bc445ddf3e4bff4a5c168/server/src/auth/strategies/jwt.strategy.ts#L13-L32"
},
{
"name": "VulnCheck Advisory: Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kubero-3.0.0-through-3.1.1-authentication-bypass-via-hardcoded-jwt-secret"
}
],
"title": "Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-125370",
"datePublished": "2026-11-09T23:27:41.949Z",
"dateReserved": "2026-11-09T22:03:03.950Z",
"dateUpdated": "2026-11-13T13:52:37.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124604 (GCVE-0-2026-124604)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:21 – Updated: 2026-11-12 17:27
VLAI
EPSS
VEX
Title
Hardcoded RSA Private Key and Public Key Exposure in GV-Cloud Android Application v1.5.1
Summary
The RSA cryptographic key
material, including a private key and public key, is embedded within the GV-Cloud application package. Because Android applications can be extracted and
reverse engineered, storing private cryptographic keys directly inside the
client application may allow an attacker to recover the keys and potentially
use them to impersonate the application, decrypt protected data, or generate
unauthorized cryptographic operations.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 17:27 UTC
CWE
- CWE-321 - Use of hard-coded cryptographic key
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GeoVision Inc. | GV-Cloud |
Affected:
1.5.1
Unaffected: 1.5.2 cpe:2.3:a:geovision_inc.:gv-cloud:1.5.1:*:android:*:*:*:*:* |
Date Public
2026-11-09 00:20
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124604",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T17:27:13.455417Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:27:25.716Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "tw.com.geovision.nativityGvloud",
"platforms": [
"Android"
],
"product": "GV-Cloud",
"vendor": "GeoVision Inc.",
"versions": [
{
"status": "affected",
"version": "1.5.1"
},
{
"status": "unaffected",
"version": "1.5.2"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:geovision_inc.:gv-cloud:1.5.1:*:android:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:geovision_inc.:gv-cloud:1.5.2:*:android:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloyd Lexter Gealon"
}
],
"datePublic": "2026-11-09T00:20:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe RSA\u0026nbsp;cryptographic key\nmaterial, including a private key and public key, is embedded within the GV-Cloud application package.\u0026nbsp;Because Android applications can be extracted and\nreverse engineered, storing private cryptographic keys directly inside the\nclient application may allow an attacker to recover the keys and potentially\nuse them to impersonate the application, decrypt protected data, or generate\nunauthorized cryptographic operations.\u003c/p\u003e"
}
],
"value": "The RSA\u00a0cryptographic key\nmaterial, including a private key and public key, is embedded within the GV-Cloud application package.\u00a0Because Android applications can be extracted and\nreverse engineered, storing private cryptographic keys directly inside the\nclient application may allow an attacker to recover the keys and potentially\nuse them to impersonate the application, decrypt protected data, or generate\nunauthorized cryptographic operations."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
},
{
"capecId": "CAPEC-191",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-191 Read Sensitive Constants Within an Executable"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321 Use of hard-coded cryptographic key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:21:50.561Z",
"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
"shortName": "GV"
},
"references": [
{
"url": "https://www.geovision.com.tw/cyber_security.php"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Hardcoded RSA Private Key and Public Key Exposure in GV-Cloud Android Application v1.5.1",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
"assignerShortName": "GV",
"cveId": "CVE-2026-124604",
"datePublished": "2026-11-10T00:21:50.561Z",
"dateReserved": "2026-11-09T01:42:46.616Z",
"dateUpdated": "2026-11-12T17:27:25.716Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124602 (GCVE-0-2026-124602)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:23 – Updated: 2026-11-12 17:28
VLAI
EPSS
VEX
Title
Hardcoded RSA Private Key and Public Key Exposure in GV-Access Android Application v1.6.1
Summary
The RSA cryptographic
key material, including a private key and public key, is embedded within the GV-Access application package. Because Android applications can be extracted and
reverse engineered, storing private cryptographic keys directly inside the
client application may allow an attacker to recover the keys and potentially
use them to impersonate the application, decrypt protected data, or generate
unauthorized cryptographic operations.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 17:28 UTC
CWE
- CWE-321 - Use of hard-coded cryptographic key
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GeoVision Inc. | GV-Access |
Affected:
1.6.1
Unaffected: 1.6.2 cpe:2.3:a:geovision_inc.:gv-access:1.6.1:*:android:*:*:*:*:* |
Date Public
2026-11-09 02:35
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124602",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T17:28:32.608791Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:28:58.806Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "tw.com.geovision.gvaccesscontrol",
"platforms": [
"Android"
],
"product": "GV-Access",
"vendor": "GeoVision Inc.",
"versions": [
{
"status": "affected",
"version": "1.6.1"
},
{
"status": "unaffected",
"version": "1.6.2"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:geovision_inc.:gv-access:1.6.1:*:android:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:geovision_inc.:gv-access:1.6.2:*:android:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloyd Lexter Gealon"
}
],
"datePublic": "2026-11-09T02:35:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe RSA cryptographic\nkey material, including a private key and public key, is embedded within the GV-Access application package.\u0026nbsp;Because Android applications can be extracted and\nreverse engineered, storing private cryptographic keys directly inside the\nclient application may allow an attacker to recover the keys and potentially\nuse them to impersonate the application, decrypt protected data, or generate\nunauthorized cryptographic operations.\u003c/p\u003e"
}
],
"value": "The RSA cryptographic\nkey material, including a private key and public key, is embedded within the GV-Access application package.\u00a0Because Android applications can be extracted and\nreverse engineered, storing private cryptographic keys directly inside the\nclient application may allow an attacker to recover the keys and potentially\nuse them to impersonate the application, decrypt protected data, or generate\nunauthorized cryptographic operations."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
},
{
"capecId": "CAPEC-191",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-191 Read Sensitive Constants Within an Executable"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321 Use of hard-coded cryptographic key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:23:36.427Z",
"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
"shortName": "GV"
},
"references": [
{
"url": "https://www.geovision.com.tw/cyber_security.php"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Hardcoded RSA Private Key and Public Key Exposure in GV-Access Android Application v1.6.1",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
"assignerShortName": "GV",
"cveId": "CVE-2026-124602",
"datePublished": "2026-11-10T00:23:36.427Z",
"dateReserved": "2026-11-09T01:42:46.616Z",
"dateUpdated": "2026-11-12T17:28:58.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124599 (GCVE-0-2026-124599)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:21 – Updated: 2026-11-12 17:26
VLAI
EPSS
VEX
Title
Hardcoded RSA Private Key and Public Key Exposure in GV-Face Android Application v2.2.1
Summary
The RSA cryptographic key material, including a private key and public key, is
embedded within the application package. Because Android applications can
be extracted and reverse engineered, storing private cryptographic keys
directly inside the client application may allow an attacker to recover the
keys and potentially use them to impersonate the application, decrypt protected
data, or generate unauthorized cryptographic operations.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 17:25 UTC
CWE
- CWE-321 - Use of hard-coded cryptographic key
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GeoVision Inc. | GV-Face |
Affected:
2.2.1
Unaffected: 2.2.2 cpe:2.3:a:geovision_inc.:gv-face:2.2.1:*:android:*:*:*:*:* |
Date Public
2026-11-09 02:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124599",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T17:25:29.230280Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:26:05.083Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "tw.com.geovision.face",
"platforms": [
"Android"
],
"product": "GV-Face",
"vendor": "GeoVision Inc.",
"versions": [
{
"status": "affected",
"version": "2.2.1"
},
{
"status": "unaffected",
"version": "2.2.2"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:geovision_inc.:gv-face:2.2.1:*:android:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:geovision_inc.:gv-face:2.2.2:*:android:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloyd Lexter Gealon"
}
],
"datePublic": "2026-11-09T02:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe RSA cryptographic key material, including a private key and public key, is\nembedded within the application package.\u0026nbsp;Because Android applications can\nbe extracted and reverse engineered, storing private cryptographic keys\ndirectly inside the client application may allow an attacker to recover the\nkeys and potentially use them to impersonate the application, decrypt protected\ndata, or generate unauthorized cryptographic operations.\u003c/p\u003e"
}
],
"value": "The RSA cryptographic key material, including a private key and public key, is\nembedded within the application package.\u00a0Because Android applications can\nbe extracted and reverse engineered, storing private cryptographic keys\ndirectly inside the client application may allow an attacker to recover the\nkeys and potentially use them to impersonate the application, decrypt protected\ndata, or generate unauthorized cryptographic operations."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
},
{
"capecId": "CAPEC-191",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-191 Read Sensitive Constants Within an Executable"
}
]
},
{
"capecId": "CAPEC-545",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-545 Pull Data from System Resources"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321 Use of hard-coded cryptographic key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:21:11.810Z",
"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
"shortName": "GV"
},
"references": [
{
"url": "https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/2026/Security_Advisory_GV-Eye-2026-09-01.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Hardcoded RSA Private Key and Public Key Exposure in GV-Face Android Application v2.2.1",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
"assignerShortName": "GV",
"cveId": "CVE-2026-124599",
"datePublished": "2026-11-10T00:21:11.810Z",
"dateReserved": "2026-11-09T01:42:46.616Z",
"dateUpdated": "2026-11-12T17:26:05.083Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124598 (GCVE-0-2026-124598)
Vulnerability from cvelistv5 – Published: 2026-11-10 00:18 – Updated: 2026-11-12 17:08
VLAI
EPSS
VEX
Title
Hardcoded API Key Discovered in GV-Face Android Application v2.2.1
Summary
An
API key is hardcoded and retrievable from the GV-Face package. Since
Android applications can be reverse engineered, embedding sensitive API
credentials directly in the client application may allow unauthorized users to
extract and misuse the key.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 17:08 UTC
CWE
- CWE-321 - Use of hard-coded cryptographic key
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GeoVision Inc. | GV-Face |
Affected:
2.2.1
Unaffected: 2.2.2 cpe:2.3:a:geovision_inc.:gv-face:2.2.1:*:*:*:*:*:*:* |
Date Public
2026-11-09 01:55
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124598",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T17:08:18.909919Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:08:39.602Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "tw.com.geovision.face",
"product": "GV-Face",
"vendor": "GeoVision Inc.",
"versions": [
{
"status": "affected",
"version": "2.2.1"
},
{
"status": "unaffected",
"version": "2.2.2"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:geovision_inc.:gv-face:2.2.1:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:geovision_inc.:gv-face:2.2.2:*:*:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lloyd Lexter Gealon"
}
],
"datePublic": "2026-11-09T01:55:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn\nAPI key is hardcoded and retrievable from the GV-Face package. Since\nAndroid applications can be reverse engineered, embedding sensitive API\ncredentials directly in the client application may allow unauthorized users to\nextract and misuse the key.\u003c/p\u003e"
}
],
"value": "An\nAPI key is hardcoded and retrievable from the GV-Face package. Since\nAndroid applications can be reverse engineered, embedding sensitive API\ncredentials directly in the client application may allow unauthorized users to\nextract and misuse the key."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "CWE-321 Use of hard-coded cryptographic key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T00:18:17.969Z",
"orgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
"shortName": "GV"
},
"references": [
{
"url": "https://www.geovision.com.tw/cyber_security.php"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Hardcoded API Key Discovered in GV-Face Android Application v2.2.1",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0df08a0e-a200-4957-9bb0-084f562506f9",
"assignerShortName": "GV",
"cveId": "CVE-2026-124598",
"datePublished": "2026-11-10T00:18:17.969Z",
"dateReserved": "2026-11-09T01:42:46.616Z",
"dateUpdated": "2026-11-12T17:08:39.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120209 (GCVE-0-2026-120209)
Vulnerability from cvelistv5 – Published: 2026-10-31 17:25 – Updated: 2026-11-02 14:37
VLAI
EPSS
VEX
Title
AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token
Summary
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:37 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://gitee.com/belief-team/report/issues/IKRV6T | issue-tracking |
| https://gitee.com/belief-team/report/blob/V1.7.1/… | technical-description |
| https://gitee.com/belief-team/report | product |
| https://www.vulncheck.com/advisories/aj-report-th… | third-party-advisory |
Impacted products
Date Public
2026-10-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120209",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:37:42.918684Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:37:55.775Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AJ-Report",
"repo": "https://gitee.com/belief-team/report",
"vendor": "anji-plus",
"versions": [
{
"lessThanOrEqual": "1.7.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:anji-plus:aj-report:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "LionTree"
}
],
"datePublic": "2026-10-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode \u0027dataSet\u0027 to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T17:25:56.161Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://gitee.com/belief-team/report/issues/IKRV6T"
},
{
"tags": [
"technical-description"
],
"url": "https://gitee.com/belief-team/report/blob/V1.7.1/report-core/src/main/java/com/anjiplus/template/gaea/business/util/JwtUtil.java"
},
{
"tags": [
"product"
],
"url": "https://gitee.com/belief-team/report"
},
{
"name": "VulnCheck Advisory: AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/aj-report-through-1.7.1-authentication-bypass-leading-to-rce-via-share-token"
}
],
"title": "AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120209",
"datePublished": "2026-10-31T17:25:56.161Z",
"dateReserved": "2026-10-31T11:44:49.569Z",
"dateUpdated": "2026-11-02T14:37:55.775Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119597 (GCVE-0-2026-119597)
Vulnerability from cvelistv5 – Published: 2026-10-30 13:18 – Updated: 2026-11-05 21:27
VLAI
EPSS
VEX
Title
OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery
Summary
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:27 UTC
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/AIDotNet/OpenDeepWiki/commit/1… | patch |
| https://github.com/AIDotNet/OpenDeepWiki/issues/403 | issue-tracking |
| https://github.com/AIDotNet/OpenDeepWiki/blob/v2.… | technical-description |
| https://github.com/AIDotNet/OpenDeepWiki/blob/v2.… | technical-description |
| https://hackmd.io/@hieuPenguinnn/opendeepwiki-har… | third-party-advisory |
| https://github.com/AIDotNet/OpenDeepWiki | product |
| https://www.vulncheck.com/advisories/opendeepwiki… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AIDotNet | OpenDeepWiki |
Affected:
0 , ≤ 2.0.6
(semver)
|
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119597",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:27:04.837030Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:27:33.465Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/opendeepwiki-hardcoded-jwt-secret-admin-forgery"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenDeepWiki",
"repo": "https://github.com/AIDotNet/OpenDeepWiki",
"vendor": "AIDotNet",
"versions": [
{
"lessThanOrEqual": "2.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:18:17.101Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/AIDotNet/OpenDeepWiki/commit/1bf0f4b5ef8d972ca640e5df145b5813a9492544"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/AIDotNet/OpenDeepWiki/issues/403"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/appsettings.json#L27"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/AIDotNet/OpenDeepWiki/blob/v2.0.6/src/OpenDeepWiki/Program.cs#L92"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/opendeepwiki-hardcoded-jwt-secret-admin-forgery"
},
{
"tags": [
"product"
],
"url": "https://github.com/AIDotNet/OpenDeepWiki"
},
{
"name": "VulnCheck Advisory: OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opendeepwiki-through-2.0.6-hard-coded-jwt-signing-key-admin-token-forgery"
}
],
"title": "OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119597",
"datePublished": "2026-10-30T13:18:17.101Z",
"dateReserved": "2026-10-30T11:46:45.299Z",
"dateUpdated": "2026-11-05T21:27:33.465Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Prevention schemes mirror that of hard-coded password storage.
No CAPEC attack patterns related to this CWE.