AstrBot 3.5.15 contains a hardcoded private key used for signing JWTs, specifically the key 'Advanced_System_for_Text_Response_and_Bot_Operations_Tool'. This practice violates secure key management principles (CWE-321) and can enable attackers to create valid JWTs without authorization. The vulnerability is remotely exploitable without privileges or user interaction, affecting confidentiality, integrity, and availability to a limited extent. No patch or official fix has been documented.

The exposure of a hardcoded private key used for JWT signing can allow attackers to forge tokens, potentially granting unauthorized access to protected resources or operations within AstrBot. This compromises confidentiality, integrity, and availability of the affected system. The CVSS score of 7.3 reflects a high impact but does not indicate confirmed active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider mitigating risk by restricting access to the affected application, monitoring for suspicious JWT usage, and preparing to update to a patched version once released. Avoid relying on the hardcoded key for authentication or authorization.