PowerJob Server: Authentication Bypass and Token Forgery (CVE-2026-75431)

PowerJob Server version 5.1.2 contains a critical vulnerability (CVE-2026-75431) where the HS256 JWT signing key is deterministically derived from a hardcoded constant and the MD5 hash of the configured JDBC URL. Because the JDBC URL is typically exposed in default configuration files (e.g., application-daily.properties), an attacker can autonomously compute the signing key. Combined with the ability to compute or leak the required 'encryptedToken' for accounts, this allows for the forgery of valid JWTs for any user, including administrators, and the bypass of OpenAPI authentication.

Attack Chain

1. Reconnaissance: Attacker identifies a target PowerJob Server instance exposed to the network.
2. Information Gathering: Attacker accesses the JDBC URL (typically via default config disclosure or other vulnerability) and identifies the system use of default credentials.
3. Key Derivation: Attacker performs local, offline computation: key = BASE64(BASE_SECURITY + MD5(JDBC_URL)).
4. Credential Computation: For default installations, attacker computes the encryptedToken for the admin user using the known default password.
5. Token Forgery: Attacker signs a malicious JWT using the derived key and the computed encryptedToken.
6. Exploitation: Attacker submits the forged JWT to the PowerJob web console or OpenAPI endpoints, successfully bypassing authentication to gain full administrative access.

Impact

Successful exploitation results in full administrative control over the PowerJob Server, including the ability to manage tasks, view sensitive business data, and execute operations via the OpenAPI. The vulnerability is considered critical as it allows for autonomous token forgery without requiring existing session tokens or active credentials.

Recommendation

• Upgrade PowerJob Server to a version where the JWT signing key is randomly generated and persisted, rather than derived from environment properties.
• Audit all publicly accessible configuration files and backup locations to ensure JDBC URLs and other sensitive environment properties are not exposed.
• Enforce secondary authentication and rotation policies for all administrative and OpenAPI service accounts.
• Restrict access to the PowerJob web console and OpenAPI endpoints to trusted management networks.