CVE-2026-90510mediumCWE-320CWE-321

CVE-2026-90510: medium-severity vulnerability in dromara orion-visor

dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key

Published · Updated

Follow this CVE+ Monitor orion-visor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.9epss 0.5%
A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/dromara/visor/module/asset/service/impl/HostKeyServiceImpl.java. The manipulation leads to use of hard-coded cryptographic key . The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P
Affected products
dromara · orion-visor
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — dromara orion-visor

In the same product, most dangerous first.

CVE-2026-90509MEDIUMdromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentialsEPSS 0.5%