CVE-2026-75431

PowerJob Server 5.1.2 and likely earlier versions use a predictable (hard-coded) signing key for HS256-signed JWT authentication tokens (CWE-321), meaning every deployment that keeps the default key derives the same secret. Because the key is predictable, a remote, unauthenticated attacker can forge valid JWTs for arbitrary accounts and gain full access to the server without credentials or user interaction, which per the advisory leads to arbitrary code execution. Any deployment running PowerJob Server 5.1.2 or an earlier version is affected, with internet-exposed instances most directly at risk since no authentication is needed to exploit. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known; EPSS estimates a 0.8% probability of exploitation within the next 30 days.

What to do: Upgrade PowerJob Server to a patched release newer than 5.1.2 that randomizes the JWT signing key as soon as one is available; the advisory does not yet specify a fixed version number. As interim mitigation, restrict network access to PowerJob Server to trusted clients and, if the deployment allows overriding the JWT secret, replace it with a strong, randomly generated key. Review logs for unexpected successful authentications or unfamiliar task executions, since forged tokens may appear as legitimate logins.