HIGH

CVE-2026-90509

2026-09-13 CVSS v3.1

CVSS

7.3

Description

A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Weakness (CWE)

CWE-259

CWE-798 Hard-coded Credentials

EPSS Score

0.29%

Probability of exploitation in next 30 days

21.9th percentile

References

https://github.com/dromara/orion-visor/ https://github.com/dromara/orion-visor/issues/170 https://github.com/sumo166/CVE-apply/blob/main/dromara-orion-visor/ExposeApi%20Hardcoded%20Default%20Token%20Authentication%20Bypass%20(CWE-798)_en.md https://vuldb.com/cve/CVE-2026-90509 https://vuldb.com/submit/911864 https://vuldb.com/vuln/403097 https://vuldb.com/vuln/403097/cti

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE