The vulnerability resides in the UserLoginService.createToken method of the JWT Token Handler component. The method uses a hard‑coded password for signing JWT tokens when manipulating the user_id or company_id argument. This implementation flaw allows an attacker to construct valid tokens by guessing or reusing the fixed secret, effectively creating credentials that appear legitimate. The flaw therefore permits authentication bypass and unrestricted access to protected resources without needing valid user credentials.

Affected product is zhistaredu StarTraining up to version 3.8.1. All deployments of these releases that rely on the default JWT signing configuration are susceptible.

The CVSS score is 6.9, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Because the flaw can be exploited remotely by submitting crafted JWTs, the risk is high enough to warrant immediate remediation. An attacker who obtains or forges a token can impersonate any user or elevate privileges, potentially compromising confidentiality, integrity, and availability of the services.