CVE-2026-105147: Hard-coded Credentials in SciPhi-AI R2R

This vulnerability affects SciPhi-AI R2R up to version 3.6.6 and is caused by hard-coded credentials in the JWT Secret Handler component. Specifically, the manipulation of the DEFAULT_BCRYPT_SECRET_KEY and DEFAULT_NACL_SECRET_KEY arguments leads to the presence of hard-coded secrets. The flaw allows remote attackers to initiate an attack without requiring privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. The vendor was contacted but has not provided any response or remediation. No official patch or fix is currently available.

The presence of hard-coded credentials in the JWT Secret Handler can allow remote attackers to compromise the security of the affected system by potentially bypassing authentication or gaining unauthorized access. The vulnerability does not require privileges or user interaction to exploit, increasing its risk. However, the impact is rated medium due to limited scope and complexity factors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. In the meantime, consider mitigating exposure by restricting network access to the affected component and reviewing usage of JWT secrets.