AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2019-10907

CRITICAL · CVSS 9.8 EPSS 0.92% Public Exploit

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2019-04-07 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2019-10907
Severity
CRITICAL
CVSS
9.8
EPSS
0.92%
Java

Original NVD Description

Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An attacker able to capture cookies might be able to trivially bruteforce offline the passwords of associated users.