CVE-2026-90940 in novel-plus
Summary
by MITRE • 09/14/2026
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in Novel-Plus versions through 5.3.3 constitutes a critical security flaw rooted in insecure configuration practices, specifically regarding the management of application caching mechanisms. The core issue lies within the CacheController.refreshCache endpoint, which is designed to allow administrators or authorized processes to clear and repopulate cached data to ensure users receive up-to-date information. However, this sensitive administrative function relies on a hardcoded default password for authentication rather than implementing robust access control measures such as role-based access control or dynamic token generation. This design decision creates a significant attack vector where the security of the cache management system is entirely dependent on the secrecy of a static credential that is embedded directly within the application codebase and distributed with every installation.
From a technical perspective, this flaw represents an instance of insecure default credentials, which are widely recognized as a severe risk in software development lifecycle standards such as OWASP Top 10 under categories related to broken access control and security misconfiguration. The vulnerability allows anonymous attackers to interact directly with the refreshCache endpoint by supplying the known hardcoded password within the URL path or request parameters. Because the authentication mechanism is bypassed for anyone who possesses this default value, there are no checks verifying if the requester has legitimate administrative privileges. This lack of proper authorization enforcement means that any external actor can trigger the cache invalidation process without needing to authenticate through standard login procedures or possess valid session tokens associated with an admin account.
The operational impact of exploiting this vulnerability is primarily centered around denial-of-service conditions and performance degradation rather than direct data theft, although it indirectly compromises system integrity by forcing unnecessary resource consumption. When an attacker triggers the cache invalidation endpoint using the default password, the application is compelled to clear its cached data structures. Consequently, subsequent user requests that would normally be served from memory or fast storage must instead trigger expensive database queries to repopulate the cache with fresh data. This cycle of forced cache clearing and repopulation can lead to significant latency spikes, increased load on backend databases, and potential service unavailability if the volume of invalidation attempts is high enough to exhaust system resources. While this does not directly expose sensitive user data in plaintext, it undermines the availability aspect of the CIA triad and can be used as a vector for resource exhaustion attacks.
In terms of industry classification frameworks, this vulnerability aligns with CWE-798: Use of Hard-coded Credentials, which highlights the danger of embedding static passwords within source code or configuration files that are accessible to end users. Furthermore, it relates to CWE-200: Information Exposure and CWE-613: Insufficient Session Expiration, as the lack of proper session management for administrative functions allows persistent unauthorized access. From an offensive security perspective, this behavior maps to ATT&CK technique T1499: Endpoint Denial of Service or potentially T1529: System Shutdown/Reboot if the cache invalidation leads to a crash, though it is more accurately described as resource exhaustion via application logic abuse. The exploitation does not require complex payload construction but relies on simple HTTP requests targeting specific endpoints with known credentials, making it easily exploitable by automated tools and script kiddies alike.
Mitigation strategies must focus immediately on removing the reliance on hardcoded default passwords for any administrative or sensitive operational functions. Developers should implement strong authentication mechanisms that verify user identity through secure session management rather than static secrets embedded in URLs. It is essential to enforce role-based access control so that only users with explicit administrator privileges can invoke cache refresh operations. Additionally, input validation and rate limiting should be applied to the CacheController endpoint to prevent abuse even if other security controls are bypassed. For organizations currently running affected versions of Novel-Plus, upgrading to a patched version where these defaults have been replaced is critical. In interim scenarios where an upgrade is not immediately feasible, network-level firewalls or web application firewalls can be configured to block requests containing the known default password string in the cache refresh endpoint paths until a permanent fix is deployed.