CVE-2026-90940
Received Received - Intake

Insecure Default Cache Password in novel-plus Allows Cache Invalidation

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulnCheck

Description
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90940
EUVD
EUVD-2026-77484

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
novel-plus novel-plus 5.3.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1392 The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90940 is a vulnerability in novel-plus versions up to 5.3.3 where the CacheController.refreshCache endpoint uses a hardcoded default password for cache management. Anonymous attackers can exploit this by including the known password in the URL path to invalidate portal caches, forcing unnecessary database queries to repopulate them.

Detection Guidance
  • Check if the application's cache refresh endpoint is accessible without authentication by sending a request to /cache/refresh with a known default password in the URL path.
  • Monitor access logs for requests to the cache/refresh endpoint containing the hardcoded password.
  • Use the provided PoC script to test for the vulnerability by sending requests with both correct and incorrect passwords and checking for HTTP 200 responses with code 403 in the body.
Impact Analysis

This vulnerability allows attackers to disrupt the application by invalidating caches, leading to degraded performance or denial of service. It exposes the hardcoded password in logs and headers, risking further unauthorized access. The application's lack of authentication for this endpoint exacerbates the impact.

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance as it involves cache invalidation via a hardcoded password, which is a security flaw rather than a data privacy issue. However, unauthorized cache invalidation could lead to service disruptions or excessive database queries, potentially affecting system availability and integrity.

Mitigation Strategies
  • Update novel-plus to a version that removes or secures the hardcoded cache management password.
  • Remove the hardcoded password from the application.yml configuration file and implement proper authentication for the cache refresh endpoint.
  • Restrict access to the /cache/refresh endpoint to authorized users only by adding authentication layers like Spring Security or Shiro.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90940. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart