CVE-2023-26089: Echa.europa Iuclid

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. The affected versions are 5.15.0 through 6.27.5.

Affected products

• Echa.europa Iuclid: from 5.15.0, before 6.27.6 (fixed in 6.27.6)

Published 2023-05-02. Last modified 2026-06-17.