CVE-2026-5622
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In hcengineering Huly Platform 0.7.382, the JWT Token Handler component in file foundations/core/packages/token/src/token.ts uses a hard-coded cryptographic key (SERVER_SECRET with value 'secret'). The attack can be initiated remotely but is considered difficult due to high complexity. The vendor did not respond to the disclosure.
Risk Assessment
The organization is at risk of unauthorized JWT token generation, which could lead to user impersonation and unauthorized access to the system.
Recommendation
Immediately change the default SERVER_SECRET to a strong, random key and update the Huly platform to a version containing a fix.
Original NVD description (English source)
A vulnerability was determined in hcengineering Huly Platform 0.7.382. Affected by this issue is some unknown functionality of the file foundations/core/packages/token/src/token.ts of the component JWT Token Handler. This manipulation of the argument SERVER_SECRET with the input secret causes use of hard-coded cryptographic key . The attack can be initiated remotely. The attack is considered to have high complexity. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.