CVE-2026-105392: Use of Hard-coded Cryptographic Key in Lybbn Django-Vue-Lyadmin

This vulnerability arises from the use of a hard-coded cryptographic key in the JWT signing process within Lybbn Django-Vue-Lyadmin versions 3.2.0 through 3.2.12. The SECRET_KEY parameter in the backend/application/settings.py file is not dynamically generated or securely managed, leading to potential remote exploitation. The project documentation highlights the necessity for developers to replace the default keys manually prior to deployment to avoid this security risk.

The use of a hard-coded cryptographic key weakens the security of JWT tokens, potentially allowing remote attackers to forge or manipulate tokens. This can lead to unauthorized access or privilege escalation within affected deployments if the default key is not changed. However, the vulnerability requires that developers fail to replace the default key, as noted by the project maintainer.

Developers must manually change the default hard-coded SECRET_KEY before deploying the application, as per the project maintainer's guidance. No official patch or automated fix is indicated in the advisory. Ensuring unique, securely generated keys for JWT signing is critical to mitigating this vulnerability.