DataEase’s ShareLink feature embeds the JWT signing secret 'link-pwd-fit2cloud' into the source code for all releases prior to version 2.10.24. When an attacker gains a passwordless share URL, the known secret can be used to create a linkToken JWT that passes the TokenFilter validation. This allows the attacker to act as the share creator and access protected backend resources, even if the original share has been revoked. The flaw exemplifies hardcoded cryptographic material (CWE‑321) and (CWE‑798).

All installations of the DataEase data visualization platform using dataease:dataease with a version older than 2.10.24 contain the flaw. Applying the 2.10.24 update or later removes the hardcoded signing key and eliminates the vulnerability.

The CVSS score of 8.3 indicates high severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, yet the threat remains significant because the attack requires only a passwordless share link—a capability that can be achieved through normal sharing or by discovering publicly exposed URLs. The vulnerability is not listed in the CISA KEV catalog. In the absence of remediation, an attacker who obtains a share link can forge JWTs and bypass authentication checks, enabling unauthorized backend access.