CVE-2026-97877

Deferred Deferred - Pending Action

Hard-Coded Password in StarTraining JWT Token Handler

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: VulDB

Description

A vulnerability was determined in zhistaredu StarTraining up to 3.8.1. This issue affects the function UserLoginService.createToken of the file application.yml of the component JWT Token Handler. This manipulation of the argument user_id/company_id causes use of hard-coded password. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97877

EUVD

EUVD-2026-87157

Affected Vendors & Products

Vendor	Product	Version / Range
zhistaredu	startraining	to 3.8.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-255
CWE-259	The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Attack-Flow Graph

Executive Summary

This vulnerability exists in zhistaredu StarTraining up to version 3.8.1. It involves the UserLoginService.createToken function in the application.yml file, where manipulating user_id or company_id arguments leads to the use of a hard-coded password. This allows remote attackers to potentially gain unauthorized access.

Detection Guidance

This vulnerability involves a hard-coded password in the JWT Token Handler of zhistaredu StarTraining up to version 3.8.1. Detection may require inspecting application configuration files like application.yml for hard-coded credentials and reviewing authentication token generation logic for improper handling of user_id or company_id parameters.

Impact Analysis

An attacker could exploit this to bypass authentication, gain unauthorized access to the system, or perform actions on behalf of other users. This could lead to data breaches, unauthorized modifications, or service disruption if the hard-coded password is compromised.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, fines, or reputational damage due to potential data exposure.

Mitigation Strategies

Immediately update StarTraining to the latest version beyond 3.8.1 to address the hard-coded password issue in the JWT Token Handler. If an update is unavailable, disable the affected UserLoginService.createToken function or restrict remote access to the application.yml configuration file.

Hi! I’m here to help you understand CVE-2026-97877. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70