CVE-2026-90940CWE-1392

CVE-2026-90940

Medium · published September 14, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
45.0
In the wild
Unconfirmed
What it is

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00546 · 45.0th percentile
Weakness
CWE-1392 · Use of Default Credentials
Published
2026-09-14T18:17Z
References (6)
https://github.com/201206030/novel-plus · [email protected]https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-front/src/main/java/com/java2nb/novel/controller/CacheController.java · [email protected]https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-front/src/main/resources/application.yml · [email protected]https://github.com/201206030/novel-plus/releases/tag/v5.3.3 · [email protected]https://github.com/LinYuanyi1/cve-request-poc/blob/master/novel-plus/poc-07-front-cache-refresh-hardcoded-password.py · [email protected]https://www.vulncheck.com/advisories/novel-plus-through-5.3.3-default-cache-management-password-in-the-front-portal · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 13:58Z
    novel-plus through 5.3.3 Default Cache Management Password in the Front Portal
    cvelistv5