CVE-2026-105147 | SciPhi-AI R2R up to 3.6.6 JWT Secret DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY hard-coded credentials

October 3, 2026 Yanac

A vulnerability was found in SciPhi-AI R2R up to 3.6.6. It has been rated as critical. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY causes hard-coded credentials.

This vulnerability is handled as CVE-2026-105147. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More