PowerJob Server version 5.1.2 and likely earlier versions use a predictable JWT signing key for HS256-based authentication. This vulnerability allows a remote attacker to forge valid JWT tokens and potentially execute arbitrary code on the server. The issue stems from a hardcoded or easily guessable secret in the DefaultSecretProvider implementation. References to the source code on GitHub confirm the signing key is not securely randomized. A proof-of-concept has been published on GitHub Gist, increasing the risk of active exploitation. The vulnerability affects the authentication layer of the PowerJob scheduling framework.
