This vulnerability affects the JWT Token Handler in the hcengineering Huly Platform 0.7.382, specifically in the file foundations/core/packages/token/src/token.ts. It involves the use of a hard-coded cryptographic key due to manipulation of the SERVER_SECRET input. The vulnerability allows remote attackers to potentially exploit the system, but the attack complexity is high, and no privileges or user interaction are required. The CVSS 4.0 base score is 6.3, indicating medium severity. The vendor has not provided any response or patch to date.

The vulnerability could allow remote attackers to compromise the cryptographic integrity of JWT tokens by exploiting the hard-coded key, potentially leading to unauthorized token creation or validation bypass. However, the high attack complexity and lack of known exploits in the wild reduce the immediate risk. No privilege or user interaction is required for the attack, but the impact is limited by the difficulty of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider mitigating risk by restricting access to the affected component, monitoring for suspicious token activity, and avoiding use of the affected version if possible until a patch or official guidance is released.