CVE-2026-105147: SciPhi-AI R2R JWT Secret hard-coded credentials
A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULTBCRYPTSECRETKEY/DEFAULTNACLSECRETKEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
SciPhi-AI R2R versions up to and including 3.6.6 are identified as affected. The issue is in an unspecified part of the JWT Secret Handler involving DEFAULT_BCRYPT_SECRET_KEY and DEFAULT_NACL_SECRET_KEY.
Can this be exploited remotely without authentication?
Yes. The supplied CVSS vector indicates network attack access, low complexity, no required privileges, and no user interaction.
Is exploit code or public exploitation information available?
The exploit has been publicly disclosed and may be used. The available data does not state whether active exploitation has been observed.
What should teams do if they run an affected version?
Treat affected deployments as exposed to a publicly disclosed remote issue and prioritize remediation or compensating controls. The provided information does not identify a fixed version or specific workaround.