Executive brief
Huly Platform, an open-source process management and collaboration tool, contains a security flaw in how it handles digital identity tokens. The system uses a hard-coded secret key for its JWT Token Handler, which could allow an attacker to potentially forge or manipulate security tokens. While the attack is complex to execute, it could undermine the integrity of user sessions and system security.
Technical details
A vulnerability exists in hcengineering Huly Platform 0.7.382 within the JWT Token Handler component, specifically in the file foundations/core/packages/token/src/token.ts. The application utilizes a hard-coded cryptographic key for the SERVER_SECRET argument instead of a securely generated or environment-specific secret. This flaw (CWE-321) allows for potential manipulation of JWT tokens. The attack vector is remote and requires no authentication, though it is characterized by high complexity and difficult exploitation. As of the disclosure, the vendor has not responded to reports of this issue.
Affected products
- hcengineering Huly Platform 0.7.382
Timeline
- 2026-04-06: disclosed
- 2026-04-06: advisory