CVE-2026-105392

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-105392
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105392.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-105392
Published
2026-10-05T19:45:12Z
Modified
2026-10-20T11:33:17Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key
Details

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key . Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project maintainer explains: "The issue with this key is described in the documentation. Developers need to manually change their keys before deployment."

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-320",
        "CWE-321"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105392.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "3.2.0"
                },
                {
                    "last_affected":  "3.2.0"
                },
                {
                    "introduced":  "3.2.11"
                },
                {
                    "last_affected":  "3.2.11"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/lybbn/django-vue-lyadmin

Affected ranges

Type
GIT
Repo
https://github.com/lybbn/django-vue-lyadmin
Events
Introduced
3b27d5eff8295796796b62b442cc9e3c729383dc
Last Affected
8c2d24c2ff654451a9c8728e15a7608537f32bea
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "3.2.1"
        },
        {
            "last_affected":  "3.2.1"
        },
        {
            "introduced":  "3.2.2"
        },
        {
            "last_affected":  "3.2.2"
        },
        {
            "introduced":  "3.2.3"
        },
        {
            "last_affected":  "3.2.3"
        },
        {
            "introduced":  "3.2.4"
        },
        {
            "last_affected":  "3.2.4"
        },
        {
            "introduced":  "3.2.5"
        },
        {
            "last_affected":  "3.2.5"
        },
        {
            "introduced":  "3.2.6"
        },
        {
            "last_affected":  "3.2.6"
        },
        {
            "introduced":  "3.2.7"
        },
        {
            "last_affected":  "3.2.7"
        },
        {
            "introduced":  "3.2.8"
        },
        {
            "last_affected":  "3.2.8"
        },
        {
            "introduced":  "3.2.9"
        },
        {
            "last_affected":  "3.2.9"
        },
        {
            "introduced":  "3.2.10"
        },
        {
            "last_affected":  "3.2.10"
        },
        {
            "introduced":  "3.2.12"
        },
        {
            "last_affected":  "3.2.12"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "3.2.12"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

3.*
3.2.1
3.2.10
3.2.12
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9
v3.*
v3.2.1
v3.2.10
v3.2.12
v3.2.2
v3.2.3
v3.2.4
v3.2.5
v3.2.6
v3.2.7
v3.2.8
v3.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105392.json"