Search/CVE-2026-90451
● CVE — Medium

CVE-2026-90451

DiscoveredSep 11, 2026UpdatedOct 2, 2026

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value will use the known default, allowing an attacker aware of the default to forge valid authentication cookies for that component.

CVSS v3.1
5.9 MEDIUM
EPSS
0.25%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Sep 13, 2026 → Oct 4, 2026
▼ 0.08pp
0.33% → 0.25% over 3 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityHIGH
AvailabilityNONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Connections
1 relationships
Timeline
disclosure → media coverage
Sep 11, 2026
Disclosure — published as a CVE record. · last revised by NVD Oct 2, 2026