---
id: CVE-2026-75431
title: >-
  PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT
  signing key for HS256-based authentication
summary: >-
  PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT
  signing key for HS256-based authentication. This allows a remote attacker to
  execute arbitrary code.
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-321
published: '2026-09-04'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T19:42:20.313'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75431'
references:
  - url: 'https://gist.github.com/unpredictable21/39e6ce22e4bc45b0e553d0fa6a6e4d1c'
    label: cve@mitre.org
  - url: 'https://github.com/PowerJob/PowerJob/blob/master/docker-compose.yml'
    label: cve@mitre.org
  - url: >-
      https://github.com/PowerJob/PowerJob/blob/master/powerjob-server/powerjob-server-auth/src/main/java/tech/powerjob/server/auth/jwt/impl/DefaultSecretProvider.java
    label: cve@mitre.org
  - url: >-
      https://github.com/PowerJob/PowerJob/blob/master/powerjob-server/powerjob-server-auth/src/main/java/tech/powerjob/server/auth/jwt/impl/JwtServiceImpl.java
    label: cve@mitre.org
  - url: >-
      https://github.com/PowerJob/PowerJob/blob/master/powerjob-server/powerjob-server-openapi/src/main/java/tech/powerjob/server/openapi/service/impl/OpenApiSecurityServiceImpl.java
    label: cve@mitre.org
  - url: >-
      https://github.com/PowerJob/PowerJob/blob/master/powerjob-server/powerjob-server-starter/src/main/resources/application-daily.properties
    label: cve@mitre.org
tags:
  - nvd
  - exploit-available
epss: 0.00772
epssPercentile: 0.54235
exploits:
  github: 1
  githubRepos:
    - >-
      https://github.com/unpredictable21/CVE-2026-75431_PowerJob_jwt_key_predictable
  checkedAt: '2026-09-24T07:53:16.126Z'
exploitAvailable: true
ingestedAt: '2026-09-08T20:10:03.166Z'
---

## Overview

PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.