EUVD-2026-75162
GHSA-xvj8-284g-wf2v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain hardcoded secret from public source
-
DeliveryForge administrative session token offline
-
ExploitPresent forged token to backend API
-
ExecutionBypass authentication as admin
-
ImpactFull access to protected backend endpoints
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target SPMS-Server deployment runs with the shipped default access-token secret still in place - the description states this default is 'not overridden or removed in the production environment profile,' which is the exact enabling condition. The attacker must be able to reach the backend API over the network and must know the hardcoded secret (trivially obtainable from the public source). Limiting factor: an operator who rotates or overrides the token secret in their production config eliminates the flaw, so any hardened/customized deployment is not vulnerable; there is no required user interaction and no pre-existing authentication needed. |
| Impact | The technical signals cohere around a genuinely serious flaw. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H (9.8) is well-calibrated for CWE-798: a hardcoded default access-token secret shipped in the core config and left in the production profile means any attacker who reads the public source obtains the signing secret and can forge valid administrative session tokens. Attack complexity is genuinely low (AC:L) because the secret is a fixed, published value, no privileges are needed (PR:N) since the forged token IS the authentication, and no user interaction is required (UI:N); full backend-API admin access supports C:H/I:H/A:H. However, deployment-footprint signals pull hard the other way: EPSS is only 0.24% (15th percentile), there is no CISA KEV listing, and no verified public exploit code - the only primary reference is a third-party GitHub issue (W000i/vuln#5). The low EPSS despite a 9.8 reflects the obscurity of the affected product (s-pms SPMS-Server, an early-stage project 'through v1.0'), not a weakness in the vulnerability class. Net: technically a real, easy-to-exploit auth bypass, but real-world urgency is low because almost nobody runs this software. The phrase 'remote, unauthenticated attacker can locally forge' is slightly self-contradictory but consistent with the actual mechanic - the token is forged offline using the known secret, then presented remotely over the network, so AV:N is defensible. |
| Exploit ScenarioDerived | An attacker reads the SPMS-Server source repository, extracts the hardcoded default token-signing secret from the core configuration file, and forges a JWT/session token claiming administrative identity. They present this forged token to the exposed backend API over the network and are accepted as an authenticated admin, gaining full access to protected endpoints. No public weaponized exploit is confirmed; a third-party GitHub issue documents the flaw but no verified POC exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authentication bypass in s-pms SPMS-Server (through v1.0) allows remote, unauthenticated attackers to forge valid administrative session tokens because a hardcoded default access-token secret is shipped in the core configuration file and is never overridden in the production environment profile. An attacker who extracts that secret from the publicly available source can then sign their own tokens and reach protected backend APIs with full administrative privileges, giving high confidentiality, integrity and availability impact (CVSS 9.8; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, and EPSS is low at 0.24% (15th percentile); the real limiter is deployment hygiene, since any operator who rotates or overrides the token secret removes the flaw entirely.
RemediationAI
No vendor-released patch identified at time of analysis, so the immediate and decisive action is configuration-level: replace the shipped default access-token secret in the core configuration file with a unique, cryptographically random value of at least 256 bits (for example generated with a CSPRNG or openssl rand -base64 48), and verify through the production environment profile that the override actually takes effect rather than being silently superseded by the default. Rotating the secret invalidates every previously issued legitimate session token, forcing all users to re-authenticate - a disruptive but necessary side effect that should be scheduled, and any tokens minted by an attacker are invalidated at the same time. Because the default secret is public in the source, treat all historical tokens as potentially forged and audit backend API logs for administrative actions from unexpected source addresses or unusual user agents prior to rotation. Until the default is removed upstream, also mitigate exposure by placing the backend APIs behind a reverse proxy or API gateway with strict IP allowlisting, disabling or firewalling unused management endpoints, and alerting on administrative token use from outside expected networks; these compensating controls reduce reachability but do not fix the root cause and may break legitimate remote integrations. Long-term, the project should remove the hardcoded default from the codebase and fail closed (refuse to start) when no secret is configured. Track the linked disclosure and advisory references - https://github.com/W000i/vuln/issues/5, https://nvd.nist.gov/vuln/detail/CVE-2026-71801, and https://vuldb.com/vuln/401882 - for the release of an upstream fix, and re-verify against the exact version in use before assuming patched status.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a textbook instance of CWE-798 (Use of Hard-coded Credentials) applied to session-token signing: the application's core configuration file carries a default access-token secret that functions as the HMAC/signing key for issued session or access tokens (typically a JWT-style bearer token). Because the server validates tokens purely by verifying that signature, anyone who knows the secret can mint a token with arbitrary claims - including administrative role claims - without ever authenticating. The enabling condition described by the vendor is that the shipped default is 'not overridden or removed in the production environment profile,' meaning the vulnerable state is the unconfigured, out-of-the-box deployment. The attacker's forging step is local arithmetic on the secret, but the actual exploitation path is network-based against reachable backend APIs, which matches the assessed vector's AV:N/PR:N/UI:N characteristics - no credentials, no user interaction, and no prior foothold on the server. CPE data supplied in the intelligence feed is unpopulated (n/a placeholders) and EUVD likewise lists affected versions as 'n/a n/a', so the authoritative version boundary remains the description's own statement of 'through v1.0'. Disclosure references point to a public GitHub issue (github.com/W000i/vuln/issues/5), a VulDB entry (vuldb.com/vuln/401882) and the NVD record, with ENISA EUVD-2026-75162 as the EU tracking identifier.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Public hardcoded secret makes token forgery trivial (AC:L, PR:N) and the forged token grants full admin API access (C:H/I:H/A:H) over the network (AV:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid administrative session tokens to completely bypass the authentication mechanism gaining full unauthorized access to protected backend APIs.
Executive ViewAI
A critical authentication bypass in s-pms SPMS-Server (through v1.0) lets any remote, unauthenticated party forge administrative session tokens using a hardcoded default secret shipped in the publicly available source, granting full administrative access to protected backend APIs. Because the flaw is exploitable over the network with no credentials or user interaction, any internet- or partner-reachable SPMS-Server deployment places sensitive operational data and administrative functions at risk of full compromise. The defect is fully removable through configuration discipline, so leadership should treat exposure as a deployment-hygiene issue that can be closed immediately rather than waiting on the vendor.
No vendor-released patch identified at time of analysis. Interim mitigations: rotate or override the hardcoded default access-token secret in the core configuration and ensure the production profile never uses the shipped default; invalidate all existing sessions and tokens after rotation; restrict network reachability of SPMS-Server administrative and backend APIs to trusted networks or VPN; enforce allowlisting at the reverse proxy; enable centralized logging and alerting on administrative API activity; and audit configurations for other unchanged default credentials. Authentication requirement: unauthenticated (CVSS vector PR:N). Exploitation status: no public exploit identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB