CVE-2026-103055: AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret
AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access cross-tenant live alerts, cases, agent events and graph updates through the realtime endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AiSOCto a version that resolves this vulnerability.Fixed in 12.0.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
AiSOC installations from 7.5.0 up to, but not including, 12.0.0 are exposed when the AISOC_REALTIME_JWT_SECRET environment variable is not set. The affected behavior is in the realtime WebSocket and SSE service.
What does an attacker need to exploit it?
An attacker does not need authentication, user interaction, or prior privileges. They can forge realtime subscription tickets using arbitrary tenant identifiers.
What data could be exposed?
An attacker can access cross-tenant live alerts, cases, agent events, and graph updates delivered through the realtime endpoints.
What can be done before upgrading?
Set AISOC_REALTIME_JWT_SECRET to avoid use of the hard-coded JWT verification secret. Upgrade to AiSOC 12.0.0 or later when possible.