CVE-2026-110214Low· 3.7▾ TwilightPoC availableSnowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILE_DOWNLOAD_SIGN_SECRET constant. Attackers can comp…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 20.4 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Exploit / PoC code exists
Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILE_DOWNLOAD_SIGN_SECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to download stored files such as avatars, editor images and attachments.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112345High· 8.1TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure
CVE-2026-113466Medium· 5.3MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key
CVE-2026-111612High· 7.5netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi
CVE-2026-111633High· 8.6ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key
CVE-2026-111642High· 8.8FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser
CVE-2026-111690Critical· 9.8Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass