{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/powerjob-server-5.1.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:powerjob:powerjob:5.1.2:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-75431"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PowerJob Server (5.1.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["PowerJob"],"content_html":"\u003cp\u003ePowerJob Server version 5.1.2 contains a critical vulnerability (CVE-2026-75431) where the HS256 JWT signing key is deterministically derived from a hardcoded constant and the MD5 hash of the configured JDBC URL. Because the JDBC URL is typically exposed in default configuration files (e.g., application-daily.properties), an attacker can autonomously compute the signing key. Combined with the ability to compute or leak the required 'encryptedToken' for accounts, this allows for the forgery of valid JWTs for any user, including administrators, and the bypass of OpenAPI authentication.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eReconnaissance: Attacker identifies a target PowerJob Server instance exposed to the network.\u003c/li\u003e\n\u003cli\u003eInformation Gathering: Attacker accesses the JDBC URL (typically via default config disclosure or other vulnerability) and identifies the system use of default credentials.\u003c/li\u003e\n\u003cli\u003eKey Derivation: Attacker performs local, offline computation: \u003ccode\u003ekey = BASE64(BASE_SECURITY + MD5(JDBC_URL))\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eCredential Computation: For default installations, attacker computes the \u003ccode\u003eencryptedToken\u003c/code\u003e for the admin user using the known default password.\u003c/li\u003e\n\u003cli\u003eToken Forgery: Attacker signs a malicious JWT using the derived key and the computed \u003ccode\u003eencryptedToken\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eExploitation: Attacker submits the forged JWT to the PowerJob web console or OpenAPI endpoints, successfully bypassing authentication to gain full administrative access.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative control over the PowerJob Server, including the ability to manage tasks, view sensitive business data, and execute operations via the OpenAPI. The vulnerability is considered critical as it allows for autonomous token forgery without requiring existing session tokens or active credentials.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade PowerJob Server to a version where the JWT signing key is randomly generated and persisted, rather than derived from environment properties.\u003c/li\u003e\n\u003cli\u003eAudit all publicly accessible configuration files and backup locations to ensure JDBC URLs and other sensitive environment properties are not exposed.\u003c/li\u003e\n\u003cli\u003eEnforce secondary authentication and rotation policies for all administrative and OpenAPI service accounts.\u003c/li\u003e\n\u003cli\u003eRestrict access to the PowerJob web console and OpenAPI endpoints to trusted management networks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T00:46:43Z","date_published":"2026-10-29T00:46:43Z","id":"https://feed.craftedsignal.io/briefs/2026-10-powerjob-jwt-bypass/","summary":"PowerJob Server 5.1.2 uses a predictable algorithm to generate JWT signing keys, allowing unauthenticated attackers to forge tokens and achieve full administrative account takeover or OpenAPI authentication bypass.","title":"PowerJob Server: Authentication Bypass and Token Forgery (CVE-2026-75431)","url":"https://feed.craftedsignal.io/briefs/2026-10-powerjob-jwt-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - PowerJob Server (5.1.2)","version":"https://jsonfeed.org/version/1.1"}