← Back to CVE List
CVE-2026-105392NVD
Vulnerability Summary
A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key
. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project maintainer explains: "The issue with this key is described in the documentation. Developers need to manually change their keys before deployment."
. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project maintainer explains: "The issue with this key is described in the documentation. Developers need to manually change their keys before deployment."
CVSS v4.0 Base Metrics — Score 6.9 (MEDIUM)
Attack VectorNetwork
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredNone
User InteractionNone
Confidentiality (Vulnerable System)Low
Integrity (Vulnerable System)Low
Availability (Vulnerable System)Low
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None
CVSS v3.1 Base Metrics — Score 7.3 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityLow
IntegrityLow
AvailabilityLow
Affected & Patched Versions
- Lybbn Django-Vue-Lyadmin >= 3.2.0
- Lybbn Django-Vue-Lyadmin >= 3.2.1
- Lybbn Django-Vue-Lyadmin >= 3.2.2
- Lybbn Django-Vue-Lyadmin >= 3.2.3
- Lybbn Django-Vue-Lyadmin >= 3.2.4
- Lybbn Django-Vue-Lyadmin >= 3.2.5
- Lybbn Django-Vue-Lyadmin >= 3.2.6
- Lybbn Django-Vue-Lyadmin >= 3.2.7
- Lybbn Django-Vue-Lyadmin >= 3.2.8
- Lybbn Django-Vue-Lyadmin >= 3.2.9
- Lybbn Django-Vue-Lyadmin >= 3.2.10
- Lybbn Django-Vue-Lyadmin >= 3.2.11
- Lybbn Django-Vue-Lyadmin >= 3.2.12
Not provided by cveorg for this CVE.