PowerJob EUVD-2026-71448

Exploitation requires that the PowerJob Server run with its default/predictable HS256 JWT signing key (as generated by DefaultSecretProvider rather than a per-install random secret) and that the server's console or OpenAPI endpoint be network-reachable by the attacker. No valid credentials, user interaction, or prior authentication are needed because the predictable key lets the attacker forge admin tokens directly (PR:N, UI:N, AC:L). What limits exploitation: an operator who has already configured a strong custom JWT secret is not vulnerable to trivial forgery, and instances confined to a trusted internal network sharply reduce attacker reach.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) indicates a network-reachable, low-complexity, unauthenticated attack - consistent with token forgery against an exposed server. However, A:N understates the stated impact: if the flaw yields arbitrary code execution, availability should be High (my independent assessment is 9.8 with A:H). No EPSS or KEV data was supplied, so this is not confirmed as actively exploited; treat it as high-priority-but-not-confirmed-widespread. A publicly available PoC gist raises real exploitation likelihood for internet-exposed instances. The main mitigating factor is exposure: PowerJob servers are typically internal scheduling infrastructure, so risk concentrates on instances reachable from untrusted networks. Net: a genuinely severe, easily automatable auth-bypass-to-RCE where the primary open question is exposure and patch availability, not exploitability.

An attacker locates an internet-exposed PowerJob Server, reconstructs the predictable HS256 signing key from the default secret provider, and forges a valid admin JWT - no credentials needed. Using the forged token they authenticate to the console/OpenAPI and create or trigger a job that executes an attacker-supplied script/command on a worker, achieving remote code execution. A public PoC gist demonstrates the token-forgery step.