The vulnerability CVE-2026-97877 affects zhistaredu StarTraining up to version 3.8.1. It arises from the use of a hard-coded password within the JWT Token Handler component, specifically in the UserLoginService.createToken function configured in application.yml. This allows remote attackers to manipulate the user_id or company_id parameters to exploit the hard-coded password. The issue has been publicly disclosed, but the vendor has not provided any response or remediation. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

The vulnerability enables remote attackers to exploit a hard-coded password in the JWT Token Handler, potentially allowing unauthorized access or token creation. This could lead to unauthorized authentication or session hijacking. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts as per the CVSS 4.0 vector.

No official fix or patch is currently available, and the vendor has not responded to the disclosure. Users should monitor vendor communications for updates. Until a patch is released, consider restricting network access to the affected service and reviewing authentication mechanisms to detect anomalous token creation or usage.