The vulnerability lies in the PowerJob Server’s implementation of JWT authentication. The server, from version 5.1.2 and earlier, derives the HS256 signing key from a predictable value, rather than a strong, random secret. This design flaw allows an attacker to generate a valid token without possessing any legitimate credentials. Once authenticated, the attacker can invoke privileged API calls that ultimately execute arbitrary code on the host running the PowerJob Server. The weakness is a cryptographic flaw of type “Predictable Key” which directly compromises confidentiality, integrity, and availability of the system.

Affected is the PowerJob Server component of the PowerJob open‑source workflow engine. Versions 5.1.2 and earlier are impacted. No other vendor or product is listed. The vulnerability is confined to the server application itself; client applications are not affected unless they rely on the compromised server for authentication.

The CVSS score of 9.1 classifies this as a critical vulnerability. The EPSS score is not available, but the absence of an EPSS does not diminish the severity implied by the high CVSS. The flaw is not yet listed in CISA’s KEV catalog, so no public exploits are confirmed, yet the remote nature of the attack means that an adversary can target the service over any exposed network. An attacker only needs network reachability to the PowerJob Server’s authentication endpoint and can craft a forged JWT using the predictable key, bypassing credential checks and gaining the ability to execute arbitrary code.