Hard‑coded SECRET_KEY in settings.py causes JWT tokens to be signed with a predictable key. An attacker can manipulate the value passed to the backend, forcing it to use this key and thereby generate valid tokens. The resulting tokens grant the attacker the same privileges as the original user, enabling impersonation or unauthorized access. The vulnerability is documented as a hard‑coded cryptographic key, which is a clear weakness that can be leveraged by remote actors.

All installations of Lybbn Django‑Vue‑Lyadmin up to version 3.2.12 are impacted. The vulnerability resides in the backend/application/settings.py file of the JWT Signing component. Any deployment that has not upgraded beyond 3.2.12 or has not replaced the default key is vulnerable.

The CVSS score of 6.9 suggests a medium‑high severity, and while an EPSS score is not available, the advisory states that remote exploitation is possible and has already been publicly disclosed. Based on that information, the likely attack vector is a remote network intrusion where the attacker crafts a forged token and sends it to a protected endpoint. The vulnerability is not listed in the CISA KEV catalog, so there is no indication of active widespread exploitation at this time, but the ability to bypass authentication remains a significant risk.