Executive brief
A packet-analysis component included in a larger security system ships with an example configuration file containing a fixed, publicly-known secret used to sign authentication cookies. If an organization deploys this example configuration without running the required setup routine to generate a unique secret, attackers who know the default value can forge valid authentication cookies and gain unauthorized access to analyst sessions and security-monitoring data.
Technical details
This vulnerability is a configuration/secrets management issue where a packet-analysis component's example environment file includes a hardcoded, publicly-known secret value used to cryptographically sign authentication cookies. The root cause is inadequate deployment guidance and lack of enforcement of the setup routine that should regenerate a unique secret. An attacker with network access to the component and knowledge of the default secret can forge valid authentication cookies without valid credentials, bypassing authentication entirely. No authentication is required for the initial attack (the attacker simply crafts a cookie with the known secret). The precondition is that a deployment must have copied the example configuration into active use without running the setup routine. Exploitation allows session hijacking and access to monitoring functions intended only for authenticated analysts. Patch status is not specified in the advisory, but mitigation requires running the setup routine or manually regenerating the secret.
Affected products
- <UNKNOWN> <UNKNOWN>
Timeline
- 2026-09-11: disclosed