CVE-2026-105147

HIGH 7.3

SciPhi-AI R2R JWT Secret hard-coded credentials

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-798 CWE-259
Vendor	sciphi-ai
Product	r2r
Published	Oct 4, 2026

Stay Ahead of the Next One

Get instant alerts for sciphi-ai r2r

Be the first to know when new high vulnerabilities affecting sciphi-ai r2r are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

SciPhi-AI / R2R

3.6.0 3.6.1 3.6.2 3.6.3 3.6.4 3.6.5 3.6.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/413372 vuldb.com: https://vuldb.com/vuln/413372/cti vuldb.com: https://vuldb.com/cve/CVE-2026-105147 vuldb.com: https://vuldb.com/submit/947748 gist.github.com: https://gist.github.com/DReazer/6bc4f88053ec35f8358395bcc0d1a0bb

Credits

🔍 Snkn0w (VulDB User) VulDB CNA Team