An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid administrative session tokens to completely bypass the authentication mechanism gaining full unauthorized access to protected backend APIs.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
| Link | Providers |
|---|---|
| https://github.com/W000i/vuln/issues/5 |
|
History
Wed, 09 Sep 2026 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Hardcoded Access Token Secret Allows Authentication Bypass in SPMS-Server | |
| Weaknesses | CWE-259 CWE-287 |
Wed, 09 Sep 2026 20:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid administrative session tokens to completely bypass the authentication mechanism gaining full unauthorized access to protected backend APIs. | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2026-09-09T00:00:00.000Z
Updated: 2026-09-09T20:28:12.056Z
Reserved: 2026-08-07T00:00:00.000Z
Link: CVE-2026-71801
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-09T21:17:03.473
Modified: 2026-09-09T21:17:03.473
Link: CVE-2026-71801
Redhat
No data.