This vulnerability in Xuxueli xxl-job (up to version 3.3.2) arises from the use of a hard-coded cryptographic key in the OpenAPI endpoint component, specifically within an unknown function handling the default_token argument in OpenApiController.java. The presence of a hard-coded key can weaken cryptographic protections, potentially allowing attackers to bypass authentication or other security controls. The attack vector is network-based (remote), with high complexity and no privileges or user interaction required. The CVSS 4.0 base score is 6.3, indicating medium severity.

The use of a hard-coded cryptographic key may allow an attacker to bypass security mechanisms relying on this key, potentially leading to unauthorized access or manipulation of the application. However, the high complexity and lack of known exploits in the wild reduce the immediate risk. The vulnerability affects all users running versions 3.3.0 through 3.3.2 of xxl-job.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the OpenAPI endpoint and monitor for unusual activity related to authentication tokens. Avoid exposing the vulnerable versions publicly if possible.