Hardcoded JSON Web Tokens (JWT) in Brocade ASCG before 3.5.0 (CVE-2026-87424)
38391
02 October 2026
02 October 2026
CLOSED
HIGH
8.6 - Vector String: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVE-2026-87424
|
Brocade Security Advisory ID |
BSA-2026-3973 |
|
Component |
JWT HMAC signing key |
|
|
|
CWE-321: Use of Hard-coded Cryptographic Key
Summary
A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key.
Products Affected
Brocade ASCG Standard deployment before Brocade ASCG 3.5.0
Solution
A security update is provided in Brocade ASCG 3.5.0
Notes
This is a Frontier AI discovered vulnerability.
Revision History
|
Version |
Change |
Date |
|
1.0 |
Initial Publication |
Sept 09, 2026 |
Disclaimer
THIS DOCUMENT IS PROVIDED ON AN AS-IS BASIS SOLELY FOR INFORMATIONAL PURPOSES AND DOES NOT IMPLY ANY KIND OF GUARANTY OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. YOUR USE OF THE INFORMATION CONTAINED HEREIN IS AT YOUR OWN RISK. ALL INFORMATION PROVIDED HEREIN IS BASED ON BROCADE'S CURRENT KNOWLEDGE AND UNDERSTANDING OF THE VULNERABILITY AND IMPACT TO BROCADE HARDWARE AND SOFTWARE PRODUCTS. BROCADE RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.