CVE-2026-22906 – Hardcoded Key Allows Credential Disclosure

CVE ID : CVE-2026-22906

Published : Feb. 9, 2026, 8:16 a.m. | 1 hour, 3 minutes ago

Description : User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and recover plaintext usernames and passwords, especially when combined with the authentication bypass.

Severity: 9.8 | CRITICAL

Visit the link for more details, such as CVSS details, affected products, timeline, and more…