Platform
nodejs
Component
hcengineering-huly-platform
Fixed in
0.7.383
CVE-2026-5622 affects Huly Platform versions 0.7.382–0.7.382 and involves a hardcoded cryptographic key within the JWT Token Handler. This flaw allows attackers to manipulate the SERVER_SECRET argument, potentially leading to unauthorized access and data breaches. While the vendor has not responded to early disclosure attempts, mitigation strategies are available to reduce risk.
The core impact of CVE-2026-5622 stems from the use of a hardcoded cryptographic key. An attacker who can identify and exploit this key can manipulate the SERVER_SECRET parameter within the JWT Token Handler. This could allow them to forge valid tokens, impersonate users, and gain unauthorized access to sensitive data and functionalities within the Huly Platform. The remote nature of the attack means it can be launched from anywhere with network access to the platform. The difficulty of exploitation suggests that specialized knowledge and resources may be required, but successful exploitation could have a significant blast radius, potentially compromising the entire platform.
CVE-2026-5622 was published on 2026-04-06. The vulnerability's CVSS score is LOW (3.7), indicating a relatively limited potential for widespread exploitation. No public Proof-of-Concept (POC) code is currently known. The vendor's lack of response to early disclosure attempts raises concerns about the platform's security posture and the likelihood of a timely patch. It is not currently listed on KEV or EPSS, suggesting a low to medium probability of active exploitation.
Exploit Status
EPSS
0.03% (10% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-5622 is to upgrade to a patched version of Huly Platform as soon as it becomes available. Since a fixed version is not yet released, immediate workarounds are crucial. Implement Web Application Firewall (WAF) rules to rigorously validate JWT token inputs, specifically scrutinizing the SERVER_SECRET parameter for unexpected values or patterns. Consider restricting network access to the JWT Token Handler to only trusted sources. Regularly review and audit the platform's configuration to ensure no other hardcoded secrets are present. After implementing WAF rules, verify their effectiveness by attempting to craft malicious JWT tokens and observing if they are blocked.
Actualice a una versión corregida de la plataforma Huly. La vulnerabilidad radica en el uso de una clave criptográfica codificada de forma rígida en el archivo token.ts. Verifique la documentación oficial de hcengineering para obtener instrucciones de actualización o mitigación.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-5622 is a vulnerability in Huly Platform 0.7.382 where a hardcoded cryptographic key in the JWT Token Handler allows attackers to manipulate the SERVER_SECRET, potentially leading to unauthorized access. The vulnerability has a LOW severity rating.
If you are using Huly Platform version 0.7.382, you are potentially affected by CVE-2026-5622. Monitor for updates and implement mitigation strategies until a patch is available.
The recommended fix is to upgrade to a patched version of Huly Platform. Until a patch is available, implement WAF rules to validate JWT token inputs and restrict network access to the token handler.
Currently, there is no public evidence of CVE-2026-5622 being actively exploited. However, the lack of a vendor response and the potential for remote exploitation warrant caution.
Due to the vendor's lack of response, an official advisory is not currently available. Monitor the Huly Platform website and security mailing lists for updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.