Common Weakness Enumeration
CWE-798
Allowed-with-ReviewUse of Hard-coded Credentials
Abstraction: Base · Status: Draft
The product contains hard-coded credentials, such as a password or cryptographic key.
2272 vulnerabilities reference this CWE, most recent first.
CVE-2026-74891 (GCVE-0-2026-74891)
Vulnerability from cvelistv5 – Published: 2026-08-17 11:04 – Updated: 2026-08-17 15:30
VLAI
EPSS
VEX
Title
openssl_encrypt before 1.4.0 Hardcoded Database Credentials
Summary
openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 15:30 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/jahlives/openssl_encrypt/secur… | vendor-advisory |
| https://www.vulncheck.com/advisories/openssl-encr… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jahlives | openssl_encrypt |
Affected:
0 , < 1.4.0
(semver)
Unaffected: 1.4.0 (semver) |
Date Public
2026-02-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74891",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T15:30:14.388444Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:30:32.467Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/openssl_encrypt",
"product": "openssl_encrypt",
"vendor": "jahlives",
"versions": [
{
"lessThan": "1.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.4.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-02-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T11:04:54.519Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-v4vm-4xf2-fhqj)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-v4vm-4xf2-fhqj"
},
{
"name": "VulnCheck Advisory: openssl_encrypt before 1.4.0 Hardcoded Database Credentials",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openssl-encrypt-before-hardcoded-database-credentials"
}
],
"title": "openssl_encrypt before 1.4.0 Hardcoded Database Credentials",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-74891",
"datePublished": "2026-08-17T11:04:54.519Z",
"dateReserved": "2026-08-17T10:42:40.455Z",
"dateUpdated": "2026-08-17T15:30:32.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73847 (GCVE-0-2026-73847)
Vulnerability from cvelistv5 – Published: 2026-08-14 17:33 – Updated: 2026-08-14 19:29
VLAI
EPSS
VEX
Title
Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover
Summary
Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant execute_tool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator. The authentication cookie set in include/lib/loginauth.php has no explicit SameSite attribute, enabling Chrome's temporary Lax+POST grace window. The query_database case passes attacker-controlled sql and confirm_code values to Ai::queryDatabase in include/service/ai.php; read queries need no confirmation, write queries accept the public confirm string, only the blog table is write-protected, and aliasing password as pwd_hash bypasses output redaction. A successful request can read every database table and write every table except blog, including changing the user table to take over an administrator account. No fixed version is available as of this review.
Severity
6.8 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 19:28 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/emlog/emlog/security/advisorie… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73847",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T19:28:43.567533Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T19:29:11.588Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/emlog/emlog/security/advisories/GHSA-v6wr-4x55-7qp5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "emlog",
"vendor": "emlog",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.6.26"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant execute_tool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator. The authentication cookie set in include/lib/loginauth.php has no explicit SameSite attribute, enabling Chrome\u0027s temporary Lax+POST grace window. The query_database case passes attacker-controlled sql and confirm_code values to Ai::queryDatabase in include/service/ai.php; read queries need no confirmation, write queries accept the public confirm string, only the blog table is write-protected, and aliasing password as pwd_hash bypasses output redaction. A successful request can read every database table and write every table except blog, including changing the user table to take over an administrator account. No fixed version is available as of this review."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798: Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1275",
"description": "CWE-1275: Sensitive Cookie with Improper SameSite Attribute",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T17:33:02.631Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/emlog/emlog/security/advisories/GHSA-v6wr-4x55-7qp5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/emlog/emlog/security/advisories/GHSA-v6wr-4x55-7qp5"
}
],
"source": {
"advisory": "GHSA-v6wr-4x55-7qp5",
"discovery": "UNKNOWN"
},
"title": "Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73847",
"datePublished": "2026-08-14T17:33:02.631Z",
"dateReserved": "2026-08-13T17:44:28.644Z",
"dateUpdated": "2026-08-14T19:29:11.588Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73519 (GCVE-0-2026-73519)
Vulnerability from cvelistv5 – Published: 2026-08-12 21:15 – Updated: 2026-08-13 13:41 X_Open Source
VLAI
EPSS
VEX
Title
WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret
Summary
WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the require_auth() gate without any session, API key, or user account. Attackers can reach an affected node's management port to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container via the POST /api/containers/{runtime}/{id}/exec endpoint.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 13:41 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/wolfsoftwaresystemsltd/WolfSta… | vendor-advisory |
| https://github.com/wolfsoftwaresystemsltd/WolfSta… | release-notes |
| https://www.vulncheck.com/advisories/wolfstack-ha… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wolfsoftwaresystemsltd | WolfStack |
Affected:
0 , < 25.9.2
(semver)
|
Date Public
2026-08-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73519",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T13:41:37.689801Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:41:46.430Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"packageURL": "pkg:github/wolfsoftwaresystemsltd/WolfStack",
"product": "WolfStack",
"repo": "https://github.com/wolfsoftwaresystemsltd/WolfStack",
"vendor": "wolfsoftwaresystemsltd",
"versions": [
{
"lessThan": "25.9.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dostxodjayev Abdullox (@squeeze440)"
}
],
"datePublic": "2026-08-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the require_auth() gate without any session, API key, or user account. Attackers can reach an affected node\u0027s management port to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container via the POST /api/containers/{runtime}/{id}/exec endpoint."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T21:15:33.164Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-r3mw-2wmq-j6jg)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/wolfsoftwaresystemsltd/WolfStack/security/advisories/GHSA-r3mw-2wmq-j6jg"
},
{
"name": "Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/wolfsoftwaresystemsltd/WolfStack/releases?page=7#release-v25.9.2"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wolfstack-hard-coded-secret-authentication-bypass-via-x-wolfstack-secret"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "WolfStack \u003c 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-73519",
"datePublished": "2026-08-12T21:15:33.164Z",
"dateReserved": "2026-08-12T19:29:19.866Z",
"dateUpdated": "2026-08-13T13:41:46.430Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71960 (GCVE-0-2026-71960)
Vulnerability from cvelistv5 – Published: 2026-08-19 14:27 – Updated: 2026-08-31 19:08
VLAI
EPSS
VEX
Title
Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT
Summary
Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the extracted secret to craft arbitrary JWT tokens and authenticate to the MQTT broker without legitimate credentials, gaining unauthorized access to the device's mesh networking interface.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 19:25 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.cudy.com/en-us/pages/download-center/… | release-notes |
| https://www.vulncheck.com/advisories/cudy-wr3000-… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Shenzhen Cudy Technology Co., Ltd. | WR3000 2.0 |
Affected:
0 , < 2.5.24
(semver)
|
|
| Shenzhen Cudy Technology Co., Ltd. | P5 V1.1 |
Affected:
2.4.25 , ≤ 2.4.27
(semver)
|
Date Public
2026-07-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71960",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T19:25:35.305436Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T19:25:47.794Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "WR3000 2.0",
"vendor": "Shenzhen Cudy Technology Co., Ltd.",
"versions": [
{
"lessThan": "2.5.24",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "P5 V1.1",
"vendor": "Shenzhen Cudy Technology Co., Ltd.",
"versions": [
{
"lessThanOrEqual": "2.4.27",
"status": "affected",
"version": "2.4.25",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nir Yehoshua"
}
],
"datePublic": "2026-07-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker\u0027s authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the extracted secret to craft arbitrary JWT tokens and authenticate to the MQTT broker without legitimate credentials, gaining unauthorized access to the device\u0027s mesh networking interface."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T19:08:00.967Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Release Notes",
"tags": [
"release-notes"
],
"url": "https://www.cudy.com/en-us/pages/download-center/wr3000-2-0"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cudy-wr3000-hard-coded-jwt-secret-authentication-bypass-via-mqtt"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-71960",
"datePublished": "2026-08-19T14:27:57.545Z",
"dateReserved": "2026-08-08T16:43:04.177Z",
"dateUpdated": "2026-08-31T19:08:00.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71396 (GCVE-0-2026-71396)
Vulnerability from cvelistv5 – Published: 2026-08-27 20:45 – Updated: 2026-08-28 15:57
VLAI
EPSS
VEX
Title
Use of Hard-coded Credentials in Bendix EC80 Brake ECU
Summary
Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 15:49 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
Impacted products
11 products
| Vendor | Product | Version | |
|---|---|---|---|
| Bendix | EC80ESP+ J1708 |
Affected:
Z228999
Unaffected: Z300822 |
|
| Bendix | EC80ESP+ 6S/6M |
Affected:
Z228999
Unaffected: Z300822 |
|
| Bendix | EC80ESP+ PLC |
Affected:
Z228999
Unaffected: Z300822 |
|
| Bendix | EC80ESP+ 2nd CAN |
Affected:
Z228999
Unaffected: Z300822 |
|
| Bendix | EC80ESP+ Integrated TPMS |
Affected:
Z228999
Unaffected: Z300822 |
|
| Bendix | EC80ESP 6S/6M |
Affected:
Z266494
Unaffected: Z302578 |
|
| Bendix | EC80ESP PLC |
Affected:
Z266494
Unaffected: Z302578 |
|
| Bendix | EC80ESP 2nd CAN |
Affected:
Z266494
Unaffected: Z302578 |
|
| Bendix | EC80ESP CAN Gateway |
Affected:
Z266494
Unaffected: Z302578 |
|
| Bendix | EC80ESP 4S/4M |
Affected:
Z286098
Unaffected: Z302579 |
|
| Bendix | EC80ESP PLC |
Affected:
Z286098
Unaffected: Z302579 |
Date Public
2026-08-25 14:28
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71396",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T15:49:02.909444Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T15:57:46.738Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EC80ESP+ J1708",
"vendor": "Bendix",
"versions": [
{
"status": "affected",
"version": "Z228999"
},
{
"status": "unaffected",
"version": "Z300822"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EC80ESP+ 6S/6M",
"vendor": "Bendix",
"versions": [
{
"status": "affected",
"version": "Z228999"
},
{
"status": "unaffected",
"version": "Z300822"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EC80ESP+ PLC",
"vendor": "Bendix",
"versions": [
{
"status": "affected",
"version": "Z228999"
},
{
"status": "unaffected",
"version": "Z300822"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EC80ESP+ 2nd CAN",
"vendor": "Bendix",
"versions": [
{
"status": "affected",
"version": "Z228999"
},
{
"status": "unaffected",
"version": "Z300822"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EC80ESP+ Integrated TPMS",
"vendor": "Bendix",
"versions": [
{
"status": "affected",
"version": "Z228999"
},
{
"status": "unaffected",
"version": "Z300822"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EC80ESP 6S/6M",
"vendor": "Bendix",
"versions": [
{
"status": "affected",
"version": "Z266494"
},
{
"status": "unaffected",
"version": "Z302578"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EC80ESP PLC",
"vendor": "Bendix",
"versions": [
{
"status": "affected",
"version": "Z266494"
},
{
"status": "unaffected",
"version": "Z302578"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EC80ESP 2nd CAN",
"vendor": "Bendix",
"versions": [
{
"status": "affected",
"version": "Z266494"
},
{
"status": "unaffected",
"version": "Z302578"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EC80ESP CAN Gateway",
"vendor": "Bendix",
"versions": [
{
"status": "affected",
"version": "Z266494"
},
{
"status": "unaffected",
"version": "Z302578"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EC80ESP 4S/4M",
"vendor": "Bendix",
"versions": [
{
"status": "affected",
"version": "Z286098"
},
{
"status": "unaffected",
"version": "Z302579"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EC80ESP PLC",
"vendor": "Bendix",
"versions": [
{
"status": "affected",
"version": "Z286098"
},
{
"status": "unaffected",
"version": "Z302579"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ben Gardiner of NMFTA reported this vulnerability to CISA."
}
],
"datePublic": "2026-08-25T14:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Bendix EC80 Brake ECU\u0026nbsp;uses hard-coded credentials, which could allow an attacker to disable automatic traction control."
}
],
"value": "Bendix EC80 Brake ECU\u00a0uses hard-coded credentials, which could allow an attacker to disable automatic traction control."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T20:45:52.804Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-05"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-05.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Bendix recommends users update their firmware to the most recent firmware version releases. Users that need more help should contact Bendix directly at info@Bendix.com.\u003cdiv\u003e\u003cul\u003e\u003cli\u003eEC80ESP+ J1708: Users should update their firmware to version Z300822.\u003c/li\u003e\u003cli\u003eEC80ESP+ 6S/6M:\u0026nbsp;Users\n\n\u0026nbsp;should update their firmware to version Z300822.\u003c/li\u003e\u003cli\u003eEC80ESP+ PLC:\u0026nbsp;Users\u0026nbsp;\u0026nbsp;should update their firmware to version Z300822.\u003c/li\u003e\u003cli\u003eEC80ESP+ 2nd CAN:\nUsers\u0026nbsp;should update their firmware to version Z300822.\u003c/li\u003e\u003cli\u003eEC80ESP+ Integrated TPMS:\u0026nbsp;Users\u0026nbsp;should update their firmware to version Z300822.\u003c/li\u003e\u003cli\u003eEC80ESP 6S/6M:\nUsers\nshould update their firmware to version Z302578.\u003c/li\u003e\u003cli\u003eEC80ESP PLC:\nUsers\n\nshould update their firmware to version Z302578.\u003c/li\u003e\u003cli\u003eEC80ESP 2nd CAN:\nUsers\n\nshould update their firmware to version Z302578.\u003c/li\u003e\u003cli\u003eEC80ESP CAN Gateway:\nUsers\n\nshould update their firmware to version Z302578.\u003c/li\u003e\u003cli\u003eEC80ESP 4S/4M:\nUsers\n\nshould update their firmware to version Z302579.\u003c/li\u003e\u003cli\u003eEC80ESP PLC:\nUsers\n\nshould update their firmware to version Z302579.\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e"
}
],
"value": "Bendix recommends users update their firmware to the most recent firmware version releases. Users that need more help should contact Bendix directly at info@Bendix.com. * EC80ESP+ J1708: Users should update their firmware to version Z300822.\n * EC80ESP+ 6S/6M:\u00a0Users\n\n\u00a0should update their firmware to version Z300822.\n * EC80ESP+ PLC:\u00a0Users\u00a0\u00a0should update their firmware to version Z300822.\n * EC80ESP+ 2nd CAN:\nUsers\u00a0should update their firmware to version Z300822.\n * EC80ESP+ Integrated TPMS:\u00a0Users\u00a0should update their firmware to version Z300822.\n * EC80ESP 6S/6M:\nUsers\nshould update their firmware to version Z302578.\n * EC80ESP PLC:\nUsers\n\nshould update their firmware to version Z302578.\n * EC80ESP 2nd CAN:\nUsers\n\nshould update their firmware to version Z302578.\n * EC80ESP CAN Gateway:\nUsers\n\nshould update their firmware to version Z302578.\n * EC80ESP 4S/4M:\nUsers\n\nshould update their firmware to version Z302579.\n * EC80ESP PLC:\nUsers\n\nshould update their firmware to version Z302579."
}
],
"source": {
"advisory": "ICSA-26-237-05",
"discovery": "EXTERNAL"
},
"title": "Use of Hard-coded Credentials in Bendix EC80 Brake ECU",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-71396",
"datePublished": "2026-08-27T20:45:52.804Z",
"dateReserved": "2026-08-10T16:03:40.501Z",
"dateUpdated": "2026-08-28T15:57:46.738Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71238 (GCVE-0-2026-71238)
Vulnerability from cvelistv5 – Published: 2026-08-05 10:56 – Updated: 2026-08-10 11:45
VLAI
EPSS
VEX
Title
DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery
Summary
DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 12:43 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/DjangoCRM/django-crm | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DjangoCRM | django-crm |
Affected:
0
|
Date Public
2026-08-05 10:56
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71238",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T12:43:33.263122Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:43:45.494Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "django-crm",
"programFiles": [
"webcrm/settings.py"
],
"vendor": "DjangoCRM",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mirdavlatov Mira\u0027zam"
}
],
"datePublic": "2026-08-05T10:56:33.934Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover.\u003c/p\u003e"
}
],
"value": "DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:45:42.375Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/DjangoCRM/django-crm"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-71238",
"datePublished": "2026-08-05T10:56:33.934Z",
"dateReserved": "2026-08-05T10:53:53.175Z",
"dateUpdated": "2026-08-10T11:45:42.375Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69102 (GCVE-0-2026-69102)
Vulnerability from cvelistv5 – Published: 2026-08-11 18:04 – Updated: 2026-08-14 16:51
VLAI
EPSS
VEX
Title
MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust
Summary
MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT token signed with the publicly known default secret, submit it to the /sign/login/jwt/trust endpoint, and obtain a fully authenticated admin session with access to SSO application configuration and downstream application secrets.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 16:10 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/dromara/MaxKey | product |
| https://github.com/dromara/MaxKey/issues/270 | issue-tracking |
| https://github.com/dromara/MaxKey/commit/6cda394e… | patch |
| https://www.vulncheck.com/advisories/maxkey-hard-… | third-party-advisory |
Impacted products
Date Public
2026-08-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69102",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T16:10:11.632154Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T16:58:32.371Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "MaxKey",
"vendor": "dromara",
"versions": [
{
"lessThanOrEqual": "4.1.11",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:maxkey:maxkey:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.1.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lza, Fiona"
}
],
"datePublic": "2026-08-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT token signed with the publicly known default secret, submit it to the /sign/login/jwt/trust endpoint, and obtain a fully authenticated admin session with access to SSO application configuration and downstream application secrets."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:51:16.400Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Product Repository",
"tags": [
"product"
],
"url": "https://github.com/dromara/MaxKey"
},
{
"name": "GitHub Issue",
"tags": [
"issue-tracking"
],
"url": "https://github.com/dromara/MaxKey/issues/270"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/dromara/MaxKey/commit/6cda394ec111f03a06fb2eed0de74f787d68bd97"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/maxkey-hard-coded-jwt-secret-unauthorized-access-via-login-jwt-trust"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-69102",
"datePublished": "2026-08-11T18:04:26.008Z",
"dateReserved": "2026-08-03T10:44:14.336Z",
"dateUpdated": "2026-08-14T16:51:16.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67614 (GCVE-0-2026-67614)
Vulnerability from cvelistv5 – Published: 2026-08-13 17:08 – Updated: 2026-08-14 16:51 X_Open Source
VLAI
EPSS
VEX
Title
CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal
Summary
CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 03:55 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://cyberpanel.net/KnowledgeBase/home/change-logs/ | release-notes |
| https://github.com/usmannasir/cyberpanel/issues/1858 | issue-tracking |
| https://www.vulncheck.com/advisories/cyberpanel-h… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| usmannasir | cyberpanel |
Affected:
0 , < 3.0.0
(semver)
cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:* |
Date Public
2026-08-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67614",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T03:55:58.270665Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T12:40:28.474Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"packageURL": "pkg:github/usmannasir/cyberpanel",
"product": "cyberpanel",
"repo": "https://github.com/usmannasir/cyberpanel",
"vendor": "usmannasir",
"versions": [
{
"lessThan": "3.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Deniz Mert"
}
],
"datePublic": "2026-08-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:51:02.511Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Release Notes",
"tags": [
"release-notes"
],
"url": "https://cyberpanel.net/KnowledgeBase/home/change-logs/"
},
{
"name": "Researcher Outreach",
"tags": [
"issue-tracking"
],
"url": "https://github.com/usmannasir/cyberpanel/issues/1858"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cyberpanel-hard-coded-jwt-secret-authentication-bypass-via-webterminal"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "CyberPanel \u003c 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-67614",
"datePublished": "2026-08-13T17:08:40.038Z",
"dateReserved": "2026-07-29T21:07:39.203Z",
"dateUpdated": "2026-08-14T16:51:02.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67568 (GCVE-0-2026-67568)
Vulnerability from cvelistv5 – Published: 2026-08-11 21:25 – Updated: 2026-08-12 12:52
VLAI
EPSS
VEX
Title
Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials
Summary
The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 12:51 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Quanovate Tech Inc. (operating as Mira / Mira Care) | Mira Firmware |
Affected:
1.7.1.47
(custom)
|
|
| Quanovate Tech Inc. (operating as Mira / Mira Care) | Mira Android App |
Affected:
4.5.15.4
(custom)
|
Date Public
2026-08-11 17:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67568",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T12:51:25.814588Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T12:52:01.874Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mira Firmware",
"vendor": "Quanovate Tech Inc. (operating as Mira / Mira Care)",
"versions": [
{
"status": "affected",
"version": "1.7.1.47",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "Mira Android App",
"vendor": "Quanovate Tech Inc. (operating as Mira / Mira Care)",
"versions": [
{
"status": "affected",
"version": "4.5.15.4",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Gigi Xiaoqing Liu, Muzzammil Mohammed, Narmina Karimova, and En Mong of Northeastern University SPQR Lab reported this vulnerability to Quanovate Tech."
}
],
"datePublic": "2026-08-11T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information."
}
],
"value": "The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T21:25:10.814Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required."
}
],
"value": "Users should update the Mira app to the latest version iOS v3.5.18 / Android v4.5.18. Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required."
}
],
"source": {
"advisory": "ICSMA-26-223-01",
"discovery": "EXTERNAL"
},
"title": "Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-67568",
"datePublished": "2026-08-11T21:25:10.814Z",
"dateReserved": "2026-08-03T16:54:56.478Z",
"dateUpdated": "2026-08-12T12:52:01.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65313 (GCVE-0-2026-65313)
Vulnerability from cvelistv5 – Published: 2026-07-31 07:34 – Updated: 2026-07-31 16:32
VLAI
EPSS
VEX
Title
Use of hard-coded VNC credentials in the engineering-workstation provisioning
Summary
A provisioning script used when installing HIPASE-250 (formerly 250
SCALA) engineering workstations sets a fixed, hard-coded x11vnc
password. Because the same credential is applied to every workstation
provisioned this way, an attacker with adjacent-network access who
knows the password can gain VNC access to affected workstations.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-31 16:32 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.andritz.com/ |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ANDRITZ | HIPASE-250 |
Affected:
0 , ≤ 7.20
(custom)
Unaffected: 8.15 |
|
| ANDRITZ | 250 SCALA |
Affected:
0 , ≤ 7.20
(custom)
Unaffected: 8.15 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65313",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-31T16:32:25.110078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T16:32:44.345Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "HIPASE-250",
"vendor": "ANDRITZ",
"versions": [
{
"lessThanOrEqual": "7.20",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.15"
}
]
},
{
"defaultStatus": "affected",
"product": "250 SCALA",
"vendor": "ANDRITZ",
"versions": [
{
"lessThanOrEqual": "7.20",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "8.15"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Duc Anh Nguyen (NTCS OT Penetration Testing Team)"
},
{
"lang": "en",
"type": "finder",
"value": "Ta Duc Thien (NTCS OT Penetration Testing Team)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA provisioning script used when installing HIPASE-250 (formerly 250\nSCALA) engineering workstations sets a fixed, hard-coded x11vnc\npassword. Because the same credential is applied to every workstation\nprovisioned this way, an attacker with adjacent-network access who\nknows the password can gain VNC access to affected workstations.\u003c/p\u003e"
}
],
"value": "A provisioning script used when installing HIPASE-250 (formerly 250\nSCALA) engineering workstations sets a fixed, hard-coded x11vnc\npassword. Because the same credential is applied to every workstation\nprovisioned this way, an attacker with adjacent-network access who\nknows the password can gain VNC access to affected workstations."
}
],
"impacts": [
{
"capecId": "CAPEC-70",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-70 Try Common or Default Usernames and Passwords"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392 Use of default credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-31T07:34:11.400Z",
"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"shortName": "CyberDanube"
},
"references": [
{
"url": "https://www.andritz.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Use of hard-coded VNC credentials in the engineering-workstation provisioning",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
"assignerShortName": "CyberDanube",
"cveId": "CVE-2026-65313",
"datePublished": "2026-07-31T07:34:11.400Z",
"dateReserved": "2026-07-21T20:33:52.962Z",
"dateUpdated": "2026-07-31T16:32:44.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible [REF-7].
- In Windows environments, the Encrypted File System (EFS) may provide some protection.
Mitigation
Architecture and Design
For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password or key.
Mitigation
Architecture and Design
If the product must contain hard-coded credentials or they cannot be removed, perform access control checks and limit which entities can access the feature that requires the hard-coded credentials. For example, a feature might only be enabled through the system console instead of through a network connection.
Mitigation
Architecture and Design
- For inbound authentication using passwords: apply strong one-way hashes to passwords and store those hashes in a configuration file or database with appropriate access control. That way, theft of the file/database still requires the attacker to try to crack the password. When handling an incoming password during authentication, take the hash of the password and compare it to the saved hash.
- Use randomly assigned salts for each separate hash that is generated. This increases the amount of computation that an attacker needs to conduct a brute-force attack, possibly limiting the effectiveness of the rainbow table method.
Mitigation
Architecture and Design
- For front-end to back-end connections: Three solutions are possible, although none are complete.
- The first suggestion involves the use of generated passwords or keys that are changed automatically and must be entered at given time intervals by a system administrator. These passwords will be held in memory and only be valid for the time intervals.
- Next, the passwords or keys should be limited at the back end to only performing actions valid for the front end, as opposed to having full access.
- Finally, the messages sent should be tagged and checksummed with time sensitive values so as to prevent replay-style attacks.
CAPEC-191: Read Sensitive Constants Within an Executable
An adversary engages in activities to discover any sensitive constants present within the compiled code of an executable. These constants may include literal ASCII strings within the file itself, or possibly strings hard-coded into particular routines that can be revealed by code refactoring methods including static and dynamic analysis.
CAPEC-70: Try Common or Default Usernames and Passwords
An adversary may try certain common or default usernames and passwords to gain access into the system and perform unauthorized actions. An adversary may try an intelligent brute force using empty passwords, known vendor default credentials, as well as a dictionary of common usernames and passwords. Many vendor products come preconfigured with default (and thus well-known) usernames and passwords that should be deleted prior to usage in a production environment. It is a common mistake to forget to remove these default login credentials. Another problem is that users would pick very simple (common) passwords (e.g. "secret" or "password") that make it easier for the attacker to gain access to the system compared to using a brute force attack or even a dictionary attack using a full dictionary.