All vulnerabilities
CVE-2026-105392

Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key

Lybbn Django-Vue-LyadminFrameworks
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 6 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published5 Oct 2026Updated 6 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key . Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project maintainer explains: "The issue with this key is described in the documentation. Developers need to manually change their keys before deployment."

Text from CVE List

Affected versions 13

  • Django-Vue-Lyadminaffected: 3.2.0CVE List
  • Django-Vue-Lyadminaffected: 3.2.1CVE List
  • Django-Vue-Lyadminaffected: 3.2.2CVE List
  • Django-Vue-Lyadminaffected: 3.2.3CVE List
  • Django-Vue-Lyadminaffected: 3.2.4CVE List
  • Django-Vue-Lyadminaffected: 3.2.5CVE List
  • Django-Vue-Lyadminaffected: 3.2.6CVE List
  • Django-Vue-Lyadminaffected: 3.2.7CVE List
  • Django-Vue-Lyadminaffected: 3.2.8CVE List
  • Django-Vue-Lyadminaffected: 3.2.9CVE List
  • Django-Vue-Lyadminaffected: 3.2.10CVE List
  • Django-Vue-Lyadminaffected: 3.2.11CVE List
  • Django-Vue-Lyadminaffected: 3.2.12CVE List

References 6