The flaw originates from a hard‑coded cryptographic key embedded in the JWT Token Handler of hcengineering Huly Platform 0.7.382. Because the key is stored in foundations/core/packages/token/src/token.ts and can be influenced through the SERVER_SECRET argument, an attacker who can interact with the system remotely can force the application to sign tokens with this predictable key. This enables the forging of valid JSON Web Tokens, potentially allowing an attacker to gain unauthorized access, elevate privileges, or impersonate legitimate users, thereby compromising confidentiality and integrity.

The vulnerability affects hcengineering Huly Platform version 0.7.382 only, within the token.ts file of the JWT Token Handler component. No other product versions are explicitly listed as impacted.

The CVSS score of 6.3 indicates moderate severity. However, the presence of a hard‑coded key makes the vulnerability considerably dangerous if leveraged. Exploitation requires remote interaction and is classified as high complexity, with no widely available proof‑of‑concept at present. As the vendor has not released a fix and the issue is not listed in the KEV catalog, administrators should treat this as a high‑priority risk and diligently monitor for updates.