CVE-2026-71801 Details

A vulnerability exists in s-pms SPMS-Server versions through 1.0, where a hardcoded access token secret is embedded in the core configuration file. This secret is not replaced or removed in the production environment profile, leaving the application vulnerable. A remote, unauthenticated attacker can exploit this by forging valid administrative session tokens, bypassing authentication, and gaining unauthorized access to protected backend APIs.

To address this vulnerability, remove the hardcoded secret from the application.yml file and replace it with a dynamic injection via environment variables. Implement a validation check during application startup to ensure the secret key is secure and not set to the default value. Additionally, update deployment scripts to automatically generate a secure random string for the access token secret if one is not provided.