EUVD-2026-78838

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...

CVE-2026-89026 Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...

CVE-2026-90945 Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

CVE-2026-90945 Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

the-same-key-opens-every-box-cve-2026-71960-hard-coded-jwt-secret-in-cudy-wr3000-mesh-mqtt

CVE-2026-71960 — Cudy WR3000 2.0 Mesh MQTT 代理中的硬编码 JWT 密钥 针对 Hunt-Benito 文章的 PoC 工具集 "同一把钥匙打开所有箱子：CVE-2026-71960 — Cudy 的 WR3000 Mesh MQTT 代理中的硬编码 JWT 密钥" https://www.hunt-benito.com/blog/the-same-key-opens-every-box-cve-2026-71960-hard-coded-jwt-secret-in-cudy-wr3000-mesh-mqtt/ 与 CVE-2026-71961...

CVE-2026-71960 Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the...

CVE-2026-71960 Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the...

CVE-2026-67614 CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed...

EUVD-2025-17816

Malicious code in bioql PyPI...

CVE-2023-47315

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret. The secret is hardcoded into the source code available to anyone on Git Hub. This secret is used to sign the application’s JWT token and verify the incoming user-supplied tokens...

CVE-2025-30206

Dpanel uses a hard-coded JWT secret in its default configuration, enabling attackers to forge valid tokens and bypass authentication, potentially gaining full control of the host. The GO-2025-3612 entry cites remote code execution as the outcome of this flaw in github.com/donknap/dpanel. The advi...

CVE-2024-29855

Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator...

CVE-2024-29855

Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator...

CVE-2024-29855

CVE-2024-29855 affects Veeam Recovery Orchestrator (VRO) Web Console. The root cause is a hard-coded JWT secret that enables authentication bypass, allowing an attacker to gain administrative access to the VRO web UI. Affected releases include VRO versions prior to the patched builds. According t...

CVE-2024-29855

Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator...

Delta Electronics DIAEnergie Hard-coded JWT Key (CVE-2022-3214)

Binary data deltaelectronicsdiaenergiecve-2022-3214.nbin...

CVE-2023-47315

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret. The secret is hardcoded into the source code available to anyone on Git Hub. This secret is used to sign the application’s JWT token and verify the incoming user-supplied tokens...

CVE-2023-47315

Headwind MDM Web panel 5.22.1 is affected by CVE-2023-47315 due to a hard-coded JWT secret that signs and verifies tokens, enabling Incorrect Access Control. The secret is embedded in the source, which is publicly accessible, allowing token forgery or tampering. Impact is described as high (CVSS ...

Moxa MXsecurity Series Hard-coded JWT Key Authentication Bypass (CVE-2023-33236)

Binary data moxamxsecuritycve-2023-33236.nbin...

CVE-2023-27583 Panindex uses hard coded cyptographic key

PanIndex is a network disk directory index. In Panindex prior to version 3.1.3, a hard-coded JWT key PanIndex is used. An attacker can use the hard-coded JWT key to sign JWT token and perform any actions as a user with admin privileges. Version 3.1.3 has a patch for the issue. As a workaround, on...