StarTraining EUVD-2026-87157

Exploitation requires a reachable StarTraining instance (version up to and including 3.8.1) whose JWT signing secret is the hard-coded value present in the shipped application.yml - i.e., a deployment that has not overridden the default/embedded secret. Given the secret is static across installs and disclosed publicly, an unauthenticated remote attacker can forge valid tokens with no user interaction and no prior credentials (PR:N/UI:N). The primary limiting factors are the product's rarity and whether an operator has rotated the JWT secret away from the shipped default; installations that changed the secret are not exploitable via the disclosed value.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:L/VI:L/VA:L, E:P) yields a moderate 6.9, but the vulnerability class - a hard-coded JWT signing secret exposed in application.yml, allowing an unauthenticated remote attacker to forge tokens with arbitrary user_id/company_id - is fundamentally an authentication-bypass/impersonation primitive whose impact is very likely understated at 'Low' across confidentiality and integrity; forging a token for a privileged or arbitrary account typically yields full account takeover (C:H/I:H). The E:P (Proof-of-Concept) temporal metric is corroborated by a publicly available exploit advisory on GitHub (ArrestX/startraining-advisories), so 'publicly available exploit code exists' - but this is NOT the same as active exploitation: there is no CISA KEV listing and no EPSS score provided, and given the obscurity of the product, any exploitation is far more likely to be targeted/opportunistic than widespread. Net: the technical severity of a forgeable-JWT-secret is real and higher than the headline 6.9 suggests, but real-world priority is bounded by the product's tiny deployment footprint. Note the impact discrepancy: VulDB scored all impacts Low, yet token forgery for arbitrary identities implies High impact - verify actual privilege reachable via forged tokens with the vendor or advisory.

An unauthenticated attacker retrieves the hard-coded JWT secret embedded in StarTraining's application.yml (published in the public advisory), then crafts a signed JWT setting user_id/company_id to a target or administrative identity and submits it to the application, which accepts it as valid via UserLoginService.createToken validation. This grants impersonation/authentication bypass without any credentials. A public proof-of-concept exploit exists in the referenced GitHub advisory.