# CVE-2026-96548: sfturing hosp_order hard-coded credentials in configuration

Source: https://junglewise.ai/threats/cve-2026-96548-a-flaw-has-been-found-in-sfturing-hosp-order-up-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-96548 · Severity: medium · CVSS 5.6 · Published 2026-09-23

A hospital appointment scheduling system contains hard-coded database and email server credentials in its publicly available source code repository. An attacker who gains access to the repository can obtain these credentials to directly access the database or send emails as the application, potentially exposing or modifying patient records and launching account takeover attacks via password reset emails.

Technologies: [Sfturing Hosp Order](https://junglewise.ai/threats/technologies/hosp-order). Vendors: [Sfturing](https://junglewise.ai/threats/vendors/sfturing).

## Quick answers

**Is CVE-2026-96548 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96548 being exploited in the wild.

**How severe is CVE-2026-96548?** Medium severity, with a CVSS score of 5.6, published 23 September 2026.

**Which products and versions are affected?** Sfturing Hosp Order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8.

**Is there a fix for CVE-2026-96548?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-96548 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-96548?** Check whether you run Sfturing Hosp Order at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CWE-798 (hard-coded credentials) in resource files and Java source code: jdbc.properties, system_config.properties, spring-dao.xml, and MailUtil.java commit 627f426331da8086ce8fff2017d65b1ddef384f8 contain plaintext database and SMTP user/password pairs loaded at runtime. An attacker with repository access (network-accessible on GitHub) can immediately use these credentials to authenticate to database or mail services without additional exploitation steps. The reported CVSS score of 8.1 in the issue exceeds the advisory's stated 5.6, likely due to high impact (confidentiality and integrity of patient data).

## Affected products

- sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8

## Timeline

- 2026-07-28: disclosed: Issue #119 reported on GitHub
- 2026-09-23: advisory: CVE-2026-96548 published

## References

- [https://github.com/sfturing/hosp_order/](https://github.com/sfturing/hosp_order/)
- [https://github.com/sfturing/hosp_order/issues/119](https://github.com/sfturing/hosp_order/issues/119)

## Related threats

- [sfturing hosp_order CSRF in user profile modification endpoints](https://junglewise.ai/threats/cve-2026-96551-a-vulnerability-was-determined-in-sfturing-hosp-order-up-to)
- [sfturing hosp_order reflected XSS in public search parameters](https://junglewise.ai/threats/cve-2026-95396-a-vulnerability-was-identified-in-sfturing-hosp-order-up-to)
- [sfturing hosp_order authorization bypass in order cancellation](https://junglewise.ai/threats/cve-2026-86263-sfturing-hosp-order-authorization-bypass-in-order-cancellation)
- [sfturing hosp_order authorization bypass in Order Handler](https://junglewise.ai/threats/cve-2026-86262-sfturing-hosp-order-authorization-bypass-in-order-handler)
- [sfturing hosp_order authorization bypass in Order Controller](https://junglewise.ai/threats/cve-2026-86261-sfturing-hosp-order-authorization-bypass-in-order-controller)