ETK-2026-3335Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3335",
  "cve_id": null,
  "display_id": "ETK-2026-3335",
  "ghsa_id": "GHSA-j5xh-9rjw-qmfm",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Hard-coded JWT signing secret in rust auth-framework",
  "summary": "auth-framework 0.4.x is affected when token-exchange components use default configuration or the affected factory and validation paths. An attacker who knows the embedded signing key can create tokens accepted as arbitrary subjects or scopes and obtain exchanged tokens. Exploitation requires an application to rely on the vulnerable default key handling rather than configuring its own secret.",
  "mitigation": "Upgrade auth-framework to 0.5.x or later. Until then, explicitly set a long random SecureJwtConfig JWT secret and avoid the affected factory, trait validation method, and FAPI default key configuration.",
  "vendor": "rust",
  "product": "rust:auth-framework",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.4.0, < 0.5.0"
      ],
      "ecosystem": "rust",
      "fixed_versions": [],
      "package_name": "auth-framework",
      "purl": "pkg:cargo/auth-framework"
    }
  ],
  "cwes": [
    321
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 35.455452083333334,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T05:03:14+00:00",
      "days": -0.06528762221064814,
      "is_lower_bound": true,
      "measured_at": "2026-11-03T06:37:14.905558+00:00",
      "url": "https://github.com/ciresnave/auth-framework/security/advisories/GHSA-j5xh-9rjw-qmfm"
    }
  }
}