What is the CVSS score of CVE-2026-32138?

CVE-2026-32138 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of NEXULEAN are affected by CVE-2026-32138?

CVE-2026-32138 exposes hardcoded API keys (Firebase and Web3Forms) in NEXULEAN versions prior to 2.0.0, potentially allowing unauthorized access to backend services and data.

How to fix or mitigate CVE-2026-32138?

Within 24 hours: Identify all NEXULEAN instances in your environment and document their versions; immediately rotate all Firebase and Web3Forms API keys if exposed. Within 7 days: Upgrade NEXULEAN to version 2.0.0 or later if available, or discontinue use if no patch is released; conduct audit logs for unauthorized API activity. Within 30 days: Implement secret management tools (HashiCorp Vault, AWS Secrets Manager) to prevent future hardcoded credentials; perform security assessment of any data accessed through compromised keys.

NEXULEAN CVE-2026-32138

HIGH

Improper Access Control (CWE-284)

2026-03-12 security-advisories@github.com

Authentication Bypass

8.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 14:52 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 19:16 nvd

HIGH 8.2

DescriptionGitHub Advisory

NEXULEAN is a cybersecurity portfolio & service platform for an Ethical Hacker, AI Enthusiast, and Penetration Tester. Prior to 2.0.0, a security vulnerability was identified where Firebase and Web3Forms API keys were exposed. An attacker could use these keys to interact with backend services without authentication, potentially leading to unauthorized access to application resources and user data. This vulnerability is fixed in 2.0.0.

AnalysisAI

NEXULEAN versions prior to 2.0.0 expose Firebase and Web3Forms API keys in the application, allowing unauthenticated attackers to access backend services and retrieve sensitive user data. The hardcoded credentials can be leveraged remotely without any user interaction to interact with protected resources. No patch is currently available for affected deployments.

Technical ContextAI

Classified as CWE-284 (Improper Access Control). Affects and Penetration Tester.. NEXULEAN is a cybersecurity portfolio & service platform for an Ethical Hacker, AI Enthusiast, and Penetration Tester. Prior to 2.0.0, a security vulnerability was identified where Firebase and Web3Forms API keys were exposed. An attacker could use these keys to interact with backend services without authentication, potentially leading to unauthorized access to application resources and user data. This vulnerability is fixed in 2.0.0.