CVE-2026-5622

CVE-2026-5622 is a cryptographic weakness in the Huly Platform version 0.7.382, specifically in the JWT Token Handler component (token.ts file), where the SERVER_SECRET parameter can be manipulated to trigger use of a hard-coded cryptographic key. This vulnerability affects the JWT token processing functionality of the affected platform. The vulnerability carries a low CVSS score of 3.7 with a network-based attack vector, high attack complexity, and no required user interaction. The impact is limited to integrity violations with no confidentiality or availability concerns. The high attack complexity requirement significantly increases the difficulty of exploitation and reduces the practical risk. There is no evidence of active exploitation or public exploit code availability, as indicated by the CVE not appearing on CISA's Known Exploited Vulnerabilities catalog and an inactive status on threat tracking lists. The EPSS score of 0.00035 reflects minimal observed exploitation activity across the vulnerability landscape. The vendor has not responded to early disclosure notifications, which may affect the availability of official patches or mitigation guidance.