The vulnerability stems from a hard‑coded secret used to sign JSON Web Tokens. Because the signing key is embedded in the code, an attacker can generate valid bearer tokens and use them to invoke privileged administrative actions that are normally protected. This flaw can compromise confidentiality, integrity, and availability of the system by giving attackers full control over the administrative interface. The weakness corresponds to CWE‑321, use of hard‑coded cryptographic keys.

Hitachi Coding Software Suite is affected, with all releases through version 3.3.0 vulnerable. Users of this suite should verify the exact build and plan to upgrade to a newer release that removes the hard‑coded key.

The assigned CVSS score of 9.3 indicates a high severity, and because the vulnerability is remotely exploitable via crafted bearer tokens, an attacker with internet connectivity to the affected application can trigger it without needing additional privileges. EPSS data is not provided, and the issue is not currently recorded in the CISA KEV catalog, but given the high CVSS and the ease of exploitation, the risk remains significant.