Lybbn Django-Vue-Lyadmin up to 3.2.12 JWT Signing settings.py SECRET_KEY hard-coded key

Summaryinfo

A vulnerability described as critical has been identified in Lybbn Django-Vue-Lyadmin up to 3.2.12. This affects an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRET_KEY results in hard-coded key. This vulnerability is identified as CVE-2026-105392. The attack can be executed remotely. Additionally, an exploit exists. The project maintainer explains: "The issue with this key is described in the documentation. Developers need to manually change their keys before deployment."

Detailsinfo

A vulnerability classified as critical has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. Affected is an unknown code block of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRET_KEY with an unknown input leads to a hard-coded key vulnerability. CWE is classifying the issue as CWE-321. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered. This is going to have an impact on confidentiality, integrity, and availability.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-105392. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. This vulnerability is assigned to T1600.001 by the MITRE ATT&CK project.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The project maintainer explains: "The issue with this key is described in the documentation. Developers need to manually change their keys before deployment."

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Content Management System

Vendor

• Lybbn

Name

• Django-Vue-Lyadmin

Version

• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.2.6
• 3.2.7
• 3.2.8
• 3.2.9
• 3.2.10
• 3.2.11
• 3.2.12

Website

• Product: https://github.com/lybbn/django-vue-lyadmin/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #982747: Lybbn Django-Vue-Lyadmin 6dcf930833d76d51780e12e024254a431e653f69 Hard-coded Cryptographic Key (by HiiragiHaru)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion