Refly CVE-2026-101052

Exploitation requires that the deployment run with the hard-coded/default JWT signing secret present in apps/api/src/modules/config/app.config.ts (the 'test' input value) rather than an operator-supplied secret. Where that default is used, no special conditions apply - remote unauthenticated token forgery works against default configurations of refly <=1.1.0 (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is configuration: an operator who overrides the JWT secret with a strong environment-provided value is not exploitable. No user interaction is required.

The vendor's CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC:L/VI:L/VA:L, E:P) rates this 6.9 (medium), treating the impact as merely 'low' across confidentiality, integrity and availability. That understates the class of flaw: CWE-798 hard-coded credentials in a JWT Token Handler means the token-signing secret (seeded from an 'input test' default) is publicly known, so any remote unauthenticated attacker can forge valid JWTs and impersonate arbitrary users - including administrators. That is a full authentication bypass (consistent with the 'Authentication Bypass' tag), which realistically warrants HIGH confidentiality and integrity impact, not 'low'. On the raw signals: attack vector is network, complexity low, no privileges and no user interaction required, and public POC exploit code exists (E:P, confirmed by the GitHub write-up). There is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active mass exploitation - the appropriate framing is 'publicly available exploit code exists,' distinct from in-the-wild abuse. Net: the technical severity is higher than the vendor's 6.9 suggests, but real-world priority is tempered by the product's limited deployment footprint and the fact that a security-conscious operator who overrode the default secret is not affected. Verify against the vendor/source whether the hard-coded value is a hard override or merely a fallback default, as that materially changes impact.

A remote attacker reads the publicly disclosed hard-coded JWT secret from the refly source (apps/api/src/modules/config/app.config.ts) and uses it to sign a forged JWT asserting an administrator identity. They present the forged token to the API and are granted authenticated access without any credentials. Public exploit code demonstrating this is already available on GitHub.