---
id: CVE-2026-71960
title: >-
  Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC
  signing secret vulnerability in the Mosquitto MQTT broker's authentication
  plugin that allows unauthenticated attackers to forge valid JWT tokens by
  extracting…
summary: >-
  Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC
  signing secret vulnerability in the Mosquitto MQTT broker's authentication
  plugin that allows unauthenticated attackers to forge valid JWT tokens by
  extracting…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-798
vendor: 'Shenzhen Cudy Technology Co., Ltd.'
product: WR3000 2.0
affected:
  - wr3000_2.0 < 2.5.24
  - p5_v1.1 >= 2.4.25 <= 2.4.27
published: '2026-08-19'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:40:01.933'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71960'
references:
  - url: 'https://www.cudy.com/en-us/pages/download-center/wr3000-2-0'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/cudy-wr3000-hard-coded-jwt-secret-authentication-bypass-via-mqtt
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-21T19:25:35.305436Z'
ingestedAt: '2026-09-09T22:41:20.587Z'
epss: 0.00544
epssPercentile: 0.44572
exploits:
  github: 1
  githubRepos:
    - >-
      https://github.com/Hunt-Benito/the-same-key-opens-every-box-cve-2026-71960-hard-coded-jwt-secret-in-cudy-wr3000-mesh-mqtt
  checkedAt: '2026-09-24T07:53:14.760Z'
exploitAvailable: true
---

## Overview

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the extracted secret to craft arbitrary JWT tokens and authenticate to the MQTT broker without legitimate credentials, gaining unauthorized access to the device's mesh networking interface.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.