CVE-2026-71960CWE-798hardcoded-credentials

CVE-2026-71960

Critical · published August 19, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
44.3
In the wild
Unconfirmed
What it is

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the extracted secret to craft arbitrary JWT tokens and authenticate to the MQTT broker without legitimate credentials, gaining unauthorized access to the device's mesh networking interface.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00534 · 44.3th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-08-19T19:18Z
References (2)
https://www.cudy.com/en-us/pages/download-center/wr3000-2-0 · [email protected]https://www.vulncheck.com/advisories/cudy-wr3000-hard-coded-jwt-secret-authentication-bypass-via-mqtt · [email protected]
EPSS history
Timeline
  • 19 AUG 14:27Z
    Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT
    cvelistv5