EUVD-2026-75162
GHSA-xvj8-284g-wf2v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Public hardcoded secret makes token forgery trivial (AC:L, PR:N) and the forged token grants full admin API access (C:H/I:H/A:H) over the network (AV:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid administrative session tokens to completely bypass the authentication mechanism gaining full unauthorized access to protected backend APIs.
AnalysisAI
Authentication bypass in s-pms SPMS-Server (through v1.0) allows remote, unauthenticated attackers to forge valid administrative session tokens because a hardcoded default access-token secret is shipped in the core configuration file and is never overridden in the production environment profile. An attacker who extracts that secret from the publicly available source can then sign their own tokens and reach protected backend APIs with full administrative privileges, giving high confidentiality, integrity and availability impact (CVSS 9.8; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target SPMS-Server deployment runs with the shipped default access-token secret still in place - the description states this default is 'not overridden or removed in the production environment profile,' which is the exact enabling condition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The technical signals cohere around a genuinely serious flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis, so the immediate and decisive action is configuration-level: replace the shipped default access-token secret in the core configuration file with a unique, cryptographically random value of at least 256 bits (for example generated with a CSPRNG or `openssl rand -base64 48`), and verify through the production environment profile that the override actually takes effect rather than being silently superseded by the default. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every SPMS-Server instance through v1.0, confirm which are reachable from untrusted networks, and immediately rotate or override the hardcoded default access-token secret in the core configuration so the production environment profile no longer uses the shipped default; restart services and invalidate all existing sessions and tokens to prevent replayed or pre-forged administrative credentials. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today