This vulnerability exists in the OpenApiController.java file of the xxl-job-admin component in Xuxueli xxl-job versions 3.3.0 through 3.3.2. The issue arises from the use of a hard-coded cryptographic key associated with the default_token argument, which may allow an attacker to manipulate authentication or authorization mechanisms remotely. The attack complexity is high, and the vulnerability does not require privileges or user interaction. The CVSS 4.0 base score is 6.3, indicating medium severity.

The use of a hard-coded cryptographic key can weaken the security of the OpenAPI endpoint, potentially allowing unauthorized remote access or manipulation of the system. However, the high complexity of exploitation and lack of known active exploits reduce the immediate risk. The vulnerability could lead to partial compromise of confidentiality, integrity, or availability of the affected component if successfully exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the OpenAPI endpoint to trusted networks or users to reduce exposure. Monitor vendor channels for updates regarding patches or official mitigations.