This vulnerability in refly-ai refly up to version 1.1.0 involves hard-coded credentials within the JWT Token Handler component, specifically related to the processing of apps/api/src/modules/config/app.config.ts. The flaw allows remote attackers to exploit these credentials, potentially compromising authentication mechanisms. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. The vendor was contacted but did not respond, and no official patch or remediation has been published.

Exploitation of this vulnerability could allow remote attackers to leverage hard-coded credentials to bypass authentication or gain unauthorized access to the system components that rely on the JWT Token Handler. This could lead to partial compromise of confidentiality, integrity, and availability as indicated by the CVSS vector. However, no known active exploits in the wild have been reported.

No official patch or remediation is currently available from the vendor. Users of refly-ai refly versions 1.0 and 1.1.0 should consider mitigating the risk by avoiding use of these versions or implementing compensating controls such as restricting network access to vulnerable components and monitoring for suspicious activity. Monitor vendor channels for any future updates or patches.