AstrBotDevs AstrBot 3.5.15 contains a hardcoded private key named Advanced_System_for_Text_Response_and_Bot_Operations_Tool that is used to sign JSON Web Tokens. This usage constitutes a CWE‑321 weakness – the use of a hard‑coded secret value. Attackers who can construct their own JWTs with this key can impersonate legitimate users or services, bypass authentication, and potentially execute commands or alter the bot’s behavior, leading to remote code execution.

The affected product is AstrBotDevs AstrBot, specifically version 3.5.15. No other vendors or product versions are known to be impacted. The hardcoded private key exists within the Advanced_System_for_Text_Response_and_Bot_Operations_Tool component of this release.

The EPSS score (< 1%) indicates a low but non‑zero probability of exploitation. Accordingly, the risk is primarily associated with environments where AstrBot services are exposed to network traffic and lack additional authentication or token revocation mechanisms. Attackers would need to generate a valid JWT and send it to the API, elevating privileges and potentially triggering arbitrary code execution if the bot performs privileged actions based on token claims. The vulnerability is not listed in CISA KEV, and the CVSS score of 7.3 reflects a high severity risk for affected environments.