CVE-2026-97877 zhistaredu CVE debrief

Who should care

Defenders responsible for zhistaredu StarTraining deployments, particularly those using versions up to 3.8.1, should assess exposure and prioritize remediation. This includes verifying and updating hardcoded secrets, reviewing the affected function, and ensuring secure token handling to prevent remote attacks using hardcoded passwords.

Why it matters

CVE-2026-97877 is a medium-severity vulnerability in zhistaredu StarTraining that allows remote attacks using hardcoded passwords in the JWT Token Handler. Defenders should prioritize verifying and updating hardcoded secrets, assessing exposure, and reviewing the affected function.

• Verify and update hardcoded secrets in StarTraining configuration
• Assess exposure of StarTraining instances to remote attacks
• Review and update the UserLoginService.createToken function

Technical summary

The vulnerability affects the UserLoginService.createToken function in the application.yml file of zhistaredu StarTraining up to version 3.8.1. The manipulation of user_id/company_id arguments leads to the use of hardcoded passwords, allowing remote attacks. Defenders should prioritize verifying the presence of hardcoded secrets in their StarTraining application configuration, particularly in the UserLoginService.createToken function within the application.yml file, and review and update the function to prevent such attacks.

Defensive priority

Defenders should prioritize verifying the presence of hardcoded secrets in their StarTraining application configuration, particularly in the UserLoginService.createToken function within the application.yml file.

Recommended defensive actions

• Verify the presence of hardcoded secrets in StarTraining application configuration
• Review and update the UserLoginService.createToken function in application.yml
• Assess exposure and prioritize remediation for StarTraining instances up to version 3.8.1
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in zhistaredu StarTraining. However, the vendor did not respond to early disclosure, and there is limited information on affected versions and remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.