EUVD-2026-92093

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULTBCRYPTSECRETKEY/DEFAULTNACLSECRETKEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been...

CVE-2026-105147 SciPhi-AI R2R JWT Secret hard-coded credentials

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULTBCRYPTSECRETKEY/DEFAULTNACLSECRETKEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been...

CVE-2026-105147 SciPhi-AI R2R JWT Secret hard-coded credentials

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULTBCRYPTSECRETKEY/DEFAULTNACLSECRETKEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been...

CVE-2026-105147

The SciPhi-AI R2R software (up to version 3.6.6 ) contains a vulnerability in the JWT Secret Handler component. The issue stems from the manipulation of the DEFAULT_BCRYPT_SECRET_KEY and DEFAULT_NACL_SECRET_KEY arguments, which leads to the use of hard-coded credentials . This vulnerability can b...

CVE-2026-105141

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

EUVD-2026-92086

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

CVE-2026-105141 topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

CVE-2026-105141

The topoteretes cognee software (versions up to 1.5.4 ) contains a security flaw in the JWT Signing Key Handler component. Specifically, the get_user_id_by_email function within the file cognee/modules/users/authentication/get_api_auth_backend.py allows for the manipulation of the FASTAPI_USERS_J...

CVE-2026-105141 topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

CVE-2026-105141 topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

CVE-2026-105147: Use of Hard-coded Credentials

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULTBCRYPTSECRETKEY/DEFAULTNACLSECRETKEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been...

PT-2026-104617

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get user id by email of the file cognee/modules/users/authentication/get api auth backend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPI USERS JWT...

CVE-2026-105141: Use of Hard-coded Credentials

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

PT-2026-104623

Name of the Vulnerable Software and Affected Versions SciPhi-AI R2R versions prior to 3.6.7 Description The JWT Secret Handler component contains hard-coded credentials. This issue occurs due to the manipulation of the DEFAULT BCRYPT SECRET KEY and DEFAULT NACL SECRET KEY arguments, which allows ...

PT-2026-104556

Name of the Vulnerable Software and Affected Versions Dell Container Storage Modules versions prior to 1.18.0 Description An issue exists in the CSM Authorization component due to the use of hard-coded credentials. This allows an unauthenticated attacker with remote access to potentially exploit...

CVE-2026-94592 Armatura LLC Armatura One Use of Hard-coded Credentials

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can...

CVE-2026-94592 Armatura LLC Armatura One Use of Hard-coded Credentials

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can...

EUVD-2026-91075

Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affects EasyIO FG: before 2.0b52...

CVE-2026-94592: Use of Hard-coded Credentials

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can...

CVE-2026-103096: Use of Hard-coded Credentials

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...