What’s Vulnerable › Vulnerabilities

CVE-2026-71960: Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-19 · updated 2026-10-27
• Weakness: CWE-798

Description

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the extracted secret to craft arbitrary JWT tokens and authenticate to the MQTT broker without legitimate credentials, gaining unauthorized access to the device's mesh networking interface.

Affected products

• Shenzhen Cudy Technology Co., Ltd. P5 V1.1: from 2.4.25 through 2.4.27
• Shenzhen Cudy Technology Co., Ltd. WR3000 2.0: before 2.5.24 — fixed in 2.5.24

How to fix

Upgrade to a fixed version: Shenzhen Cudy Technology Co., Ltd. WR3000 2.0 2.5.24. Check the vendor advisory for mitigations.

References

• https://www.cudy.com/en-us/pages/download-center/wr3000-2-0
• https://www.vulncheck.com/advisories/cudy-wr3000-hard-coded-jwt-secret-authentication-bypass-via-mqtt

Get alerted when CVE-2026-71960 or the next vulnerability affects your stack