CVE-2026-90451

Received Received - Intake

Authentication Cookie Forgery in Example Packet-Analysis Component

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ICS-CERT

Description

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value will use the known default, allowing an attacker aware of the default to forge valid authentication cookies for that component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-90451

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1392	The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

Attack-Flow Graph

Executive Summary

This vulnerability involves an example environment-configuration file that includes a fixed, publicly-known secret used to sign authentication cookies for a packet-analysis component. If this example file is used in a deployment without running the setup routine to regenerate the secret, the system will use the default value. Attackers aware of this default can forge valid authentication cookies to bypass security controls.

Detection Guidance

Check for the presence of the example environment-configuration file in your active configuration. Look for hardcoded secret values used for signing authentication cookies in the packet-analysis component. Verify if the secret matches the known default value mentioned in the vulnerability description.

Impact Analysis

This vulnerability allows attackers to forge authentication cookies, potentially gaining unauthorized access to the packet-analysis component. This could lead to data breaches, unauthorized monitoring, or manipulation of network traffic analysis, depending on the component's role in the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage due to potential data exposure or unauthorized system access.

Mitigation Strategies

Regenerate the secret value in the configuration file using the setup routine provided. Replace any hardcoded default secrets with a new, unique secret. Ensure the example file is not copied into active configuration without modification.

Hi! I’m here to help you understand CVE-2026-90451. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70