CVE-2025-9604
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
coze-studio up to 0.2.4 uses a hard-coded cryptographic key in backend/domain/plugin/encrypt/aes.go (AuthSecretKey/StateSecretKey/OAuthTokenSecretKey). The attack can be remote but is considered difficult and highly complex. The vendor recommended deploying a patch and plans user-defined key management via configuration.
Risk Assessment
Hard-coded keys can be extracted from code and used to decrypt data or impersonate services. The risk affects confidentiality of credentials and tokens.
Recommendation
Deploy the available patch and configure user-defined key management (e.g., with random salt). Avoid relying on embedded keys.
Other vulnerabilities in coze-studio
See all- CVE-2026-92795Medium
Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the backend network, reading responses containing sensitive information.
- CVE-2026-92788High
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete data.
Original NVD description (English source)
A vulnerability was identified in coze-studio up to 0.2.4. The impacted element is an unknown function of the file backend/domain/plugin/encrypt/aes.go. The manipulation of the argument AuthSecretKey/StateSecretKey/OAuthTokenSecretKey leads to use of hard-coded cryptographic key . It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. To fix this issue, it is recommended to deploy a patch. The vendor replied to the GitHub issue (translated from simplified Chinese): "For scenarios requiring encryption, we will implement user-defined key management through configuration and optimize the use of encryption tools, such as random salt."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS