SpringBlade versions 2.7.3 through 3.5.0 expose an internal Feign user‑creation endpoint that lacks authorization checks. An attacker who is already authenticated can send crafted POST requests to this endpoint and create a system administrator account. By forging a JWT with a hardcoded signing key that ships in public JARs, the attacker can elevate from a low‑privilege role to administrator, enabling cross‑tenant data corruption and persistent backdoor access. The issue results in complete compromise of data integrity and availability within the platform.

The vulnerability affects SpringBlade, a framework developed by SpringBlade. Users running any released version from 2.7.3 up to and including 3.5.0 are impacted; upgrading to version 5.0.0 or later removes the exposed endpoint and the hardcoded signing key.

The CVSS score of 8.6 indicates high severity, and although the EPSS score is not available, the existence of a hardcoded token key and the lack of role checks make exploitation straightforward for an authenticated user who can forge JWTs. The vulnerability is not listed in the CISA KEV catalog, but the ease of privilege escalation warrants immediate attention. Attackers would need only legitimate authentication credentials and knowledge of the build‑time key to create an admin account, so the risk to organizations running affected versions is substantial.