CVE-2026-110214: Use of Hard-coded Cryptographic Key in xiaonuobase Snowy
Description
Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILE_DOWNLOAD_SIGN_SECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to download stored files such as avatars, editor images and attachments.
CVSS v4.0
Score 6.3medium
Affected software
xiaonuobase
Snowy
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-110214 identifies a hard-coded cryptographic key vulnerability in Snowy 3.6.5. The application uses a constant HMAC key (FILE_DOWNLOAD_SIGN_SECRET) for signing download requests. Because this key is publicly known, attackers can generate valid HMAC-SHA256 signatures for arbitrary file IDs without authentication, enabling them to bypass access controls on the /dev/file/download endpoint and retrieve stored files.
Potential Impact
The vulnerability allows unauthenticated attackers to forge valid download signatures, potentially leading to unauthorized access and download of sensitive or private files stored by the application, including user avatars, editor images, and attachments. This could result in data exposure and privacy violations.
Mitigation Recommendations
No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /dev/file/download endpoint if possible and monitor for suspicious download activity. Consider rotating or invalidating the hard-coded key if feasible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-13T17:59:15.959Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ace80b32cdf04f6569c00a7
Added to database: 10/13/2026, 19:04:19 UTC
Last enriched: 10/13/2026, 19:19:58 UTC
Last updated: 10/13/2026, 19:51:05 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.