Executive brief
SPMS-Server is an administrative backend application used for personnel and resource management. The application contains a hardcoded default credential (token signing secret) that is never changed in production environments. An attacker with network access can forge administrator session tokens offline without any authentication, gaining complete unauthorized access to all protected backend APIs and sensitive business data.
Technical details
This vulnerability stems from CWE-798 (use of hardcoded credentials). The core issue is a hardcoded HMAC-SHA256 signing secret ("1234567890") in application.yml that is not overridden by the production configuration (application-production.yml). All session tokens—both standard login tokens and personal tokens—are signed using this secret. An unauthenticated remote attacker can leverage the publicly disclosed token format and known secret to locally construct valid access tokens for arbitrary user IDs (including root/admin) using HMAC-SHA256(secret, expireMillis + "." + base64(payload)). The request interceptor fully trusts tokens signed with this key, bypassing all authentication checks. No authentication is required; the attack can be performed entirely offline with a Python script. Remediation requires removing the hardcoded secret and enforcing dynamic injection via environment variables, plus startup validation to reject default/weak secrets.
Affected products
- s-pms SPMS-Server through v1.0
Timeline
- 2026-07-19: disclosed: Vulnerability disclosed on GitHub