| Package | Affected versions | Patched versions |
|---|---|---|
| No affected product versions are listed for this vulnerability yet. | ||
An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid administrative session tokens to completely bypass the authentication mechanism gaining full unauthorized access to protected backend APIs.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free