CVE-2026-101052: refly-ai refly JWT Token app.config.ts hard-coded credentials
A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are known to be affected?
The issue affects refly-ai refly versions up to and including 1.1.0. The affected code is identified as apps/api/src/modules/config/app.config.ts in the JWT Token Handler component.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
What can be done if a vendor fix is not available?
The provided information does not identify a fixed release or a vendor response. Review the affected JWT Token Handler configuration and remove or rotate any hard-coded credentials associated with the identified code path.