The vulnerability resides in Xuxueli XxL-Job's OpenAPI endpoint, where manipulation of the default_token parameter causes the application to use a hard‑coded cryptographic key. Based on the description, it is inferred that this may allow an attacker to bypass authentication and access privileged API routes that can trigger arbitrary job executions or other sensitive operations. The CVE description indicates that the exploit can be launched remotely and requires a high level of complexity, but it has been publicly disclosed.

Affected releases are Xuxueli XxL-Job versions 3.3.2 and earlier, specifically the xxl-job-admin module that hosts the OpenAPI endpoint. All instances running any of these versions expose the vulnerability until a release that removes the hard‑coded key or implements proper token handling is deployed.

The CVSS score of 6.3 denotes medium severity; no EPSS data is available, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is remote, needing only HTTP requests to the OpenAPI endpoint, and though the exploit is considered difficult due to high complexity, public disclosure implies a realistic threat. Therefore, administrators should evaluate the risk of unauthorized access to the job scheduler and mitigate accordingly.