CVE-2026-82827: A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-01 · updated 2026-10-01
Weakness: CWE-321

Description

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through 3.3.0.

Affected products

Hitachi Industrial Equipment Systems Hitachi Coding Software Suite: through 3.3.0

References

https://www.hitachi-ies.com/common/documents/vulnerability/hcss/Hitachi_Coding_Software_Suite_Public_statement_20260925_EN.pdf

Get alerted when CVE-2026-82827 or the next vulnerability affects your stack