Huly Platform CVE-2026-5622

The CVSS v3.1 score of 3.7 reflects a low-severity profile: network-accessible attack vector (AV:N) but high complexity (AC:H) requiring significant skill and effort to exploit. The vector indicates unauthenticated access (PR:N) with integrity impact only (I:L), no confidentiality or availability impact. The exploit proof-of-concept indicator (E:P) suggests experimental or limited evidence of exploitability. Cross-referencing signals: high attack complexity (AC:H) and the vendor's non-response suggest this is not trivial to weaponize despite the remote attack vector. The absence of EPSS probability data and no CISA KEV confirmation indicate this is not a high-priority active threat. SSVC framework assessment suggests automatable exploitation is unlikely due to AC:H; technical impact is limited to token integrity, not system compromise. This is a valid cryptographic weakness but in a specific component with non-trivial exploitation barriers-priority should be moderate rather than critical.

An attacker with network access to a Huly Platform instance could craft malicious JWT tokens by reverse-engineering or predicting the hard-coded cryptographic key used by the token.ts component. By manipulating the SERVER_SECRET argument to reveal or reuse the embedded key material, the attacker could generate forged authentication tokens to bypass token validation or impersonate legitimate users. However, the high attack complexity (AC:H) means the attacker must possess significant cryptographic expertise and understanding of the platform's internal token structure; no public exploit code has been identified, making this a theoretical but viable attack vector requiring specialized knowledge rather than automated exploitation tools.