CVE-2026-103055

Published: Set 30, 2026 Last Modified: Set 30, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,7
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH 7,5
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none

Description

AI Translation Available

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOC_REALTIME_JWT_SECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access cross-tenant live alerts, cases, agent events and graph updates through the realtime endpoints.

321

Use of Hard-coded Cryptographic Key

Draft
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism Gain Privileges Or Assume Identity Read Application Data
Applicable Platforms
Technologies: ICS/OT
View CWE Details
https://github.com/beenuar/AiSOC/blob/v11.2.0/services/realtime/src/auth.ts#L51…
https://github.com/beenuar/AiSOC/commit/2f0e954f2febecb3720e6eadb017546c5d121c43
https://github.com/beenuar/AiSOC/releases/tag/v12.0.0
https://github.com/beenuar/AiSOC/security/advisories/GHSA-4m55-xhcm-wjcr
https://www.vulncheck.com/advisories/aisoc-7.5.0-before-12.0.0-authentication-b…