CVE-2026-82825
CriticalCVSS 9.8Summary
Hitachi Coding Software Suite up to version 3.3.0 has missing authentication for critical functions. An unauthenticated attacker can invoke critical APIs, potentially leading to unauthorized retrieval or alteration of sensitive information.
Risk Assessment
Missing authentication for critical APIs allows an attacker to manipulate or steal data without any credentials, posing a serious security threat.
Recommendation
Immediately add authentication and access control to all critical APIs, and conduct a security audit.
Other vulnerabilities in Hitachi Coding Software Suite
See all- CVE-2026-82828High
Hitachi Coding Software Suite up to version 3.3.0 contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations.
- CVE-2026-82826High
Hitachi Coding Software Suite up to version 3.3.0 transmits sensitive information in cleartext, allowing an attacker to eavesdrop on authentication credentials and sensitive data in transit.
- CVE-2026-82829Critical
Hitachi Coding Software Suite up to version 3.3.0 contains a hidden functionality vulnerability that allows an attacker to gain unauthorized access by exploiting hidden accounts or hard-coded credentials.
- CVE-2026-82827Critical
Hitachi Coding Software Suite up to version 3.3.0 uses a hard-coded cryptographic key for JWT signing, allowing an attacker to generate unauthorized Bearer tokens and exploit administrative functions.
- CVE-2026-82824Critical
Hitachi Coding Software Suite up to version 3.3.0 contains a Path Traversal vulnerability that allows an attacker to access, create, modify, or delete files.
Original NVD description (English source)
Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critical API, potentially leading to unauthorized retrieval or alteration of sensitive information, or unauthorized manipulation. This issue affects Hitachi Coding Software Suite: through 3.3.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS