Hard-coded HMAC Key Vulnerability in Snowy Product by Xiaonuo

CVE-2026-110214

What is CVE-2026-110214?

In Snowy version 3.6.5, a vulnerability exists due to a hard-coded HMAC key that attackers can exploit to forge download signatures. By utilizing the publicly exposed FILE_DOWNLOAD_SIGN_SECRET constant, unauthenticated users can generate HMAC-SHA256 signatures for any file ID. This allows them to download sensitive stored files, including user avatars, editor images, and attachments, without proper authentication.

References