CVE-2026-71801

s-pms SPMS-Server through v1.0 contains a hardcoded default access token secret in its core configuration file, and this value is not overridden or removed in the production environment profile. A remote, unauthenticated attacker who recovers the default secret (e.g., from the distributed source or a default installation) can locally forge valid administrative session tokens and present them to the application. This completely bypasses the authentication mechanism and grants full unauthorized access to protected backend APIs, impacting confidentiality, integrity, and availability (CVSS 3.1: 9.8, CWE-798). Any deployment running SPMS-Server v1.0 or earlier that has not replaced the default secret is affected. No public PoC exists, the issue is not in the CISA KEV catalog, and EPSS is very low (0.2% over 30 days), so no in-the-wild exploitation is known.

What to do: Audit any SPMS-Server deployment for the default token secret in the core configuration file, replace it with a unique high-entropy value in the production profile, and invalidate all outstanding session tokens. Because every version through v1.0 is affected and no fixed release is indicated, restrict network access to the backend APIs (VPN or IP allowlisting) and review authentication logs for signs of forged administrative tokens. Contact the vendor for a patched release that removes the hardcoded credential.