Description

PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-04T16:17:59.413Z",
  "pubdate": "2026-09-04T16:17:59.413Z",
  "executiveSummary": "PowerJob Server version 5.1.2 and earlier contain a critical security vulnerability involving the use of a predictable signing key for JSON Web Tokens (JWT) utilizing the HS256 algorithm.\nThis vulnerability constitutes a broken authentication mechanism, enabling remote, unauthenticated attackers to forge arbitrary JWTs.\nBy bypassing the standard authentication verification process, an attacker can assume administrative privileges within the PowerJob environment.\nThe successful exploitation of this flaw leads to full system compromise, as unauthorized access grants the ability to execute arbitrary code on the underlying host, facilitating data exfiltration, service disruption, or further lateral movement within the network infrastructure.\nThe risk is categorized as critical due to the lack of exploitation complexity and the potential for complete system takeover.",
  "technicalDetails": "The vulnerability resides in the PowerJob Server's implementation of the JWT (JSON Web Token) authentication mechanism. Specifically, the system utilizes the HS256 (HMAC with SHA-256) symmetric signature algorithm to verify user identity and session integrity.\nThe root cause of this flaw is the reliance on a static, predictable, or hardcoded signing key used by the server to sign and validate these tokens. Because the server does not employ a cryptographically secure, randomized secret, or a properly managed key rotation policy, an attacker can determine or brute-force the signing key with minimal effort.\nThe attack flow commences with the attacker acquiring a valid JWT from the server, which is easily obtainable through normal application interaction. Once the token is captured, the attacker uses the identified predictable key to craft a malicious JWT. By modifying the claims within the payload—specifically the user identity or role fields—and re-signing the token using the HS256 algorithm and the recovered key, the attacker generates a forged session token.\nWhen the forged JWT is submitted to the PowerJob Server, the server's verification logic successfully validates the HMAC signature because it matches the signature derived from the compromised secret. The server subsequently treats the request as originating from an authorized administrator.\nUpon establishing an authenticated session, the attacker leverages the PowerJob Server's administrative functionality. Given that PowerJob is designed for task scheduling and distributed execution, an authenticated user possesses the authority to deploy and trigger arbitrary job scripts or command-line operations.\nThe exploitation culminates in Remote Code Execution (RCE), as the attacker submits job definitions containing malicious payloads to the server, which are then executed by the server or connected worker nodes. The vulnerability is present in all versions up to 5.1.2. The network exposure is broad, as the administrative interface is typically reachable over the network to facilitate distributed management, and no external user interaction is required for the exploitation process."
}