CVE-2026-107243
Received Received - Intake

Hardcoded Session Secret in Versa VOS Web Service

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: HackerOne

Description
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment.  Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-107243
EUVD
EUVD-2026-120673

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
versa vos *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a hardcoded secret in the express-session middleware of a Node.js web service used for Zero Touch Provisioning (ZTP) on VOS appliances. The secret is identical across all devices, allowing attackers to forge valid session cookies by computing the correct HMAC-SHA256 signature if they obtain a session ID.

Detection Guidance

Check if the Node.js web service is running on VOS appliances by inspecting active processes or listening ports. Look for the express-session middleware with a hardcoded secret in server.js. Verify if session cookies are being signed with a shared secret across devices.

Impact Analysis

An attacker could impersonate legitimate users by forging session cookies, gaining unauthorized access to VOS appliances. This could lead to data breaches, unauthorized configuration changes, or control over the appliance. The impact is higher if the Node.js service remains enabled after provisioning.

Compliance Impact

This vulnerability could lead to unauthorized access and data exposure, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected VOS appliances may fail compliance audits if the Node.js service is not disabled post-provisioning.

Mitigation Strategies

Disable the Node.js web service on all VOS appliances as recommended by Versa’s security hardening guide. Ensure the service is not running and remove or secure any hardcoded secrets in server.js. Rotate any existing session cookies if the service was previously active.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107243. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...