PatchSiren cyber security CVE debrief
CVE-2026-5622 hcengineering CVE debrief
A vulnerability was determined in hcengineering Huly Platform 0.7.382. Affected by this issue is some unknown functionality of the file foundations/core/packages/token/src/token.ts of the component JWT Token Handler. This manipulation of the argument SERVER_SECRET with the input secret causes use of hard-coded cryptographic key. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitation is known to be difficult.
- Vendor
- hcengineering
- Product
- Huly Platform
- CVSS
- LOW 2.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-04-06
- Original CVE updated
- 2026-07-24
- Advisory published
- 2026-04-06
- Advisory updated
- 2026-07-24
Who should care
Users of hcengineering Huly Platform 0.7.382, particularly those responsible for vulnerability management, security teams, and platform operators, should assess the risk of this vulnerability and apply patches or mitigations as available. This involves reviewing system configurations, ensuring that the JWT Token Handler is properly secured, and monitoring for any suspicious activity related to the manipulation of SERVER_SECRET. Additionally, affected teams should prioritize patching or updating the vulnerable component to prevent potential remote attacks.
Technical summary
The vulnerability is in the JWT Token Handler component of hcengineering Huly Platform 0.7.382, specifically in the file foundations/core/packages/token/src/token.ts. The issue involves the use of a hard-coded cryptographic key when manipulating the SERVER_SECRET argument with the input 'secret'. The attack vector is remote, with high complexity and difficult exploitation. This could allow attackers to compromise the security of the platform by exploiting the hard-coded key. Users should review the configuration of the JWT Token Handler to ensure it is not exposed to remote attackers and consider implementing compensating controls such as additional authentication or access controls.
Defensive priority
Apply patches or updates from the vendor as soon as available. In the absence of patches, review the configuration of the JWT Token Handler to ensure that it is not exposed to remote attackers. Monitor for any suspicious activity related to the manipulation of SERVER_SECRET.
Recommended defensive actions
- Inventory and assess the vulnerability of hcengineering Huly Platform 0.7.382 instances.
- Apply patches or updates from the vendor as soon as available.
- Review the configuration of the JWT Token Handler to ensure that it is not exposed to remote attackers.
- Monitor for any suspicious activity related to the manipulation of SERVER_SECRET.
- Consider implementing compensating controls such as additional authentication or access controls.
Evidence notes
The CVE record was published on 2026-04-06T05:16:02.650Z and was last modified on 2026-07-24T09:10:00.153Z. The NVD entry is currently Deferred. The vendor was contacted early about this disclosure but did not respond in any way.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-06T05:16:02.650Z and has not been modified since then. The NVD entry is currently Deferred.