CVE-2026-90509
Received Received - Intake

Hard-Coded Credentials in Orion Visor

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90509
EUVD
EUVD-2026-76982

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dromara orion_visor 2.5.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.
CWE-259 The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90509 is a vulnerability in the dromara orion-visor platform up to version 2.5.7. It involves a hardcoded default token 'pmqeHOyZaumH0Wt' in the production configuration file. If the API_EXPOSE_TOKEN environment variable is not set, attackers can use this token to bypass authentication on internal agent-facing APIs marked with the @ExposeApi annotation. The vulnerability exists due to a trust boundary failure in the ExposeApiAspect.beforeExposeApi() method.

Detection Guidance

Check for exposed API endpoints with the path prefix /orion-visor/api by inspecting network traffic or server logs. Look for requests using the hardcoded token pmqeHOyZaumHm0Wt in the Authorization header. Verify if the ExposeApiAspect.beforeExposeApi method is active in the application logs.

Impact Analysis

An attacker could remotely access all @ExposeApi endpoints without authentication. This allows manipulation of agent states, forging heartbeats, injecting fake monitoring data, and accessing sensitive host specifications. The impact includes unauthorized system control, data tampering, and potential compromise of the entire O&M platform.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. It enables unauthorized access to sensitive system data and operations, which could lead to breaches of confidentiality and integrity. Organizations using affected versions may fail GDPR's data protection principles or HIPAA's access control requirements.

Mitigation Strategies

Immediately rotate the hardcoded token pmqeHOyZaumHm0Wt by setting a unique API_EXPOSE_TOKEN environment variable. Remove the hardcoded token from application-prod.yaml. Restrict access to /orion-visor/api endpoints using IP whitelisting or stronger authentication like mTLS or JWT. Monitor for unauthorized API access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90509. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart