CVE-2026-101052 - refly-ai refly JWT Token app.config.ts hard-coded credentials

Back Back to CVE browser

MEDIUM

refly-ai refly JWT Token app.config.ts hard-coded credentials

Published Sep 28, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.45%

Description

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Refly-AI Product Refly Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -
- Version
  1.1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Refly-AI

Refly

n/a

Version	Status	Constraints
1.0	affected	-
1.1.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-259

CWE-798

Hard-coded Credentials

References (5)

https://github.com/DReazer/CV3/blob/main/refly/Hard-coded.md
exploit
https://vuldb.com/cve/CVE-2026-101052
third-party-advisory
https://vuldb.com/submit/927328
third-party-advisory
https://vuldb.com/vuln/410910
vdb-entrytechnical-description
https://vuldb.com/vuln/410910/cti
signaturepermissions-required

Link	Providers	Tags
https://github.com/DReazer/CV3/blob/main/refly/Hard-coded.md		exploit
https://vuldb.com/cve/CVE-2026-101052		third-party-advisory
https://vuldb.com/submit/927328		third-party-advisory
https://vuldb.com/vuln/410910		vdb-entrytechnical-description
https://vuldb.com/vuln/410910/cti		signaturepermissions-required