NVD HIGH: CVE-2026-103055 — AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verificatio...

Wednesday, September 30, 2026 at 01:16 AM UTC·Source: NIST NVD

Updated: Thursday, October 1, 2026 at 04:02 PM UTC

Executive Summary

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOC_REALTIME_JWT_SECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access cross-tenant live alerts, cases, agent events and graph updates through the realtime endpoints.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-103055

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Sep 30, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

YARA-X 1.21.0 Release, (Sat, Oct 3rd)

YARA-X&&#x23;x26;&#x23;39;s 1.21.0 release brings 5 improvements and 4 bugfixes.

1h agoSANS ISC

MEDIUMVulnerability

Danish university DTU breach exposes data of up to 200,000 people

The Technical University of Denmark (DTU) says information belonging to up to 200,000 users may have been exposed after hackers accessed its identity and access management system and downloaded a large amount of data. [...]

1h agoBleepingComputer

CRITICALVulnerability

DHS readies major cyber contract

Justin Doubleday reports: The Department of Homeland Security is preparing this year to award a major cloud, cybersecurity and network services contract aimed at further centralizing the management of IT services across DHS. In a notice posted to Sam.gov last month, DHS laid out the notional timeline for award of the Network, Cloud and Cybersecurity... Source

1h agoDataBreaches.net