Hard-Coded Credentials Vulnerability in Agnaistic Agnai by Agnaistic
CVE-2026-108753
9.3CRITICAL
What is CVE-2026-108753?
The Agnaistic Agnai application, up to version 1.0.555, contains a serious vulnerability due to hard-coded credentials in its Docker Compose configuration file. This flaw allows unauthenticated attackers to gain administrative access by using a fixed password and public JWT secret. As a result, malicious actors can log in as administrators, create their own JWTs with elevated privileges, impersonate legitimate users, reset passwords, and alter critical server settings. Organizations utilizing Agnaistic Agnai should take immediate steps to remediate this vulnerability to protect their applications from unauthorized access.
Affected Version(s)
agnai 0 <= 1.0.555
References
CVSS V4
Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology