CVE-2026-71801

Deferred Deferred - Pending Action

Hard-Coded Secret Token in SPMS-Server

Publication date: 2026-09-09

Last updated on: 2026-09-14

Assigner: MITRE

Description

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid administrative session tokens to completely bypass the authentication mechanism gaining full unauthorized access to protected backend APIs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-14

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-71801

EUVD

EUVD-2026-75162

Affected Vendors & Products

Vendor	Product	Version / Range
s-pms	spms-server	1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability involves a hardcoded default access token secret in the SPMS-Server application's core configuration file. The token is not changed in production, allowing remote unauthenticated attackers to forge valid administrative session tokens and bypass authentication. This grants full unauthorized access to protected backend APIs.

Detection Guidance

Check the core configuration file of SPMS-Server for hardcoded default access token secrets. Search for files containing 'access token' or 'secret' in the application directory. Review server logs for unusual administrative session token generation or API access patterns.

Impact Analysis

If you use SPMS-Server v1.0, an attacker could gain complete control over your system by exploiting this flaw. They could access sensitive data, modify configurations, or disrupt services without needing valid credentials.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR and HIPAA. It enables unauthorized access to sensitive data, which could lead to legal penalties, data breaches, and loss of trust.

Mitigation Strategies

Remove the hardcoded default access token secret from the configuration file. Regenerate all administrative session tokens to invalidate any potentially compromised tokens. Update the application to a patched version if available.

Hi! I’m here to help you understand CVE-2026-71801. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70