CVE-2026-75431

9.1 criticalEPSS 1.1%

Critical (9.1). EPSS 1.1% chance of exploitation in the next 30 days.

PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
CWE: CWE-321
Published: 2026-09-04
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

References

https://gist.github.com/unpredictable21/39e6ce22e4bc45b0e553d0fa6a6e4d1c
https://github.com/PowerJob/PowerJob/blob/master/docker-compose.yml
https://github.com/PowerJob/PowerJob/blob/master/powerjob-server/powerjob-server-auth/src/main/java/tech/powerjob/server/auth/jwt/impl/DefaultSecretProvider.java
https://github.com/PowerJob/PowerJob/blob/master/powerjob-server/powerjob-server-auth/src/main/java/tech/powerjob/server/auth/jwt/impl/JwtServiceImpl.java
https://github.com/PowerJob/PowerJob/blob/master/powerjob-server/powerjob-server-openapi/src/main/java/tech/powerjob/server/openapi/service/impl/OpenApiSecurityServiceImpl.java

Check your stack JSON