CVE-2026-22906 — Hardcoded Key Allows Credential Disclosure
User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and recover plaintext …
Published: 2026-02-09 · CVSS: 9.8 · CVSS 3.1
User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and recover plaintext usernames and passwords, especially when combined with the authentication bypass.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7