CVE-2026-7306

A security vulnerability has been detected in Xuxueli xxl-job up to 3.3.2. The impacted element is an unknown function of the file xxl-job-admin/src/main/java/com/xxl/job/admin/scheduler/openapi/OpenApiController.java of the component OpenAPI Endpoint. Such manipulation of the argument default_token leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used.

• CWE-320
• CWE-321

• https://github.com/xuxueli/xxl-job/
• https://github.com/xuxueli/xxl-job/issues/3938
• https://github.com/xuxueli/xxl-job/issues/3938#issuecomment-4149938881
• https://vuldb.com/submit/803077
• https://vuldb.com/vuln/359961
• https://vuldb.com/vuln/359961/cti

Published

Apr 28, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73054SiYuan versions before v3.7.4 contain an authentication bypa…7.5
• CVE-2026-73055Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to pro…4.8
• CVE-2026-73056SiYuan kernel versions before 3.7.4 contain an improper rest…9.8
• CVE-2026-73057stoatchat before 0.15.0 fails to validate SVG viewBox dimens…7.5
• CVE-2026-73058stoatchat versions before 0.15.0 fail to block the IPv6 unsp…5.8
• CVE-2026-73059stoatchat before 0.15.0 contains a permission bypass vulnera…6.5
• CVE-2026-73060Scriban versions from 3.0.0 through 7.2.5 contain a denial o…7.5
• CVE-2026-73061Scriban before 7.2.2 contains an access-modifier bypass vuln…9.8
• CVE-2026-73062Scriban versions 3.0.0 through 7.2.0 contain a denial of ser…7.5
• CVE-2026-73064In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an a…2.9
• CVE-2026-73066Tesseract is an open source OCR engine. Prior to 5.5.3, a cr…6.8
• CVE-2026-73067Tesseract is an open source OCR engine. Prior to 5.5.3, a cr…6.7