Perfree go-fastdfs-web versions 1.3.7 and earlier contain a flaw in the ShiroConfig rememberMeManager. A hard‑coded cryptographic key is used to encrypt and decrypt the RememberMe cookie, as noted in the vendor description. Because the key is static, an attacker can potentially forge or decrypt RememberMe tokens. The description does not state the exact impact, but a hard‑coded key in an authentication component commonly allows unauthorized access or session hijacking. This potential impact is inferred from the nature of the vulnerability and the use of a static key within the authentication flow.

The CVE applies to the perfree:go-fastdfs-web application, with affected versions up to version 1.3.7, as indicated in the vendor description. No later versions are mentioned in the input. Users running any release of perfree go-fastdfs-web 1.3.7 or earlier are therefore potentially vulnerable.

The CVSS score of 6.3 places the weakness in the medium severity range, while a low EPSS (<1%) suggests that it is not currently widely exploited. The vendor has not published a fix, and the CVE is not listed in the CISA KEV catalog. The attack vector is remote, exploiting the RememberMe feature; the description states that manipulation results in use of the static key, and the exploit is reported as difficult but has been released publicly. Thus, the risk is moderate with a low probability of active exploitation at present, but the availability of a public exploit makes it prudent to act.