SpringBlade versions from 2.7.3 up to, but excluding, 5.0.0 expose an internal Feign user‑creation endpoint that lacks authorization checks. An attacker who has already authenticated can send crafted POST requests to the endpoint and create a system administrator account. Because the gateway’s authentication filter only validates that a JWT can be parsed and does not verify user roles or caller identity, the hardcoded signing key bundled in publicly available JARs can be used to forge a token. This forged token lets the attacker elevate from a low‑privilege role to administrator, enabling cross‑tenant data pollution and providing a persistent backdoor. The result is a complete compromise of data integrity and availability across the platform.

The vulnerability affects SpringBlade, a framework developed by SpringBlade. Versions 2.7.3 up to, but excluding, 5.0.0 are impacted. Upgrading to version 5.0.0 or later removes the exposed endpoint and the hardcoded signing key.

The CVSS score of 8.6 denotes high severity. The EPSS score is not available, but the vulnerability’s exploitation conditions are straightforward: the gateway authentication filter only verifies JWT parsing, not user roles, and a hardcoded signing key in the JARs enables token forgery. An authenticated user who can obtain the build‑time key can create an admin account, resulting in cross‑tenant data corruption and a persistent backdoor. The vulnerability is not listed in the CISA KEV catalog, yet its ease of exploitation justifies immediate attention.