CVE-2026-90940: novel-plus Auth Bypass Vulnerability

CVE-2026-90940 Overview

CVE-2026-90940 affects novel-plus versions through 5.3.3, an open-source novel content management portal. The vulnerability resides in the CacheController.refreshCache endpoint, which validates requests using a hardcoded default password embedded in the application configuration. Unauthenticated remote attackers can invalidate the front-portal cache by sending a request to the cache/refresh path with the known default value. Successful exploitation forces the application to repopulate its caches through repeated database queries, degrading availability. The weakness is classified as CWE-1392: Use of Default Credentials.

Critical Impact

Anonymous attackers can repeatedly invalidate portal caches over the network, driving unnecessary database load and degrading availability of the novel-plus front portal.

Affected Products

• novel-plus all versions through 5.3.3
• novel-front component containing CacheController
• Deployments using the default application.yml cache password configuration

Discovery Timeline

• 2026-09-14 - CVE-2026-90940 published to the National Vulnerability Database (NVD)
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90940

Vulnerability Analysis

The novel-front module exposes a CacheController class that provides a refreshCache endpoint for administrative cache invalidation. Access control on this endpoint is gated only by a password value passed in the URL path. The expected password is loaded from application.yml and ships with a well-known default value that operators frequently fail to change. Any network client that knows or guesses the default string can invoke the endpoint. Each successful call clears the front-portal caches and forces subsequent user traffic to trigger fresh database reads. Repeated invocation converts a lightweight HTTP request into sustained backend pressure. Because the endpoint does not require authentication beyond the shared secret, no session or account is needed to abuse it.

Root Cause

The root cause is the shipping of a hardcoded default cache-management password in the distributed application.yml. The CacheController.refreshCache handler treats this shared secret as sufficient authorization, with no additional identity, role, or rate-limiting checks. This aligns with CWE-1392, the use of default credentials.

Attack Vector

Exploitation requires only network reachability to the front portal and no user interaction. An attacker issues an HTTP GET request to the cache refresh path, supplying the default password value in the URL segment expected by the controller. The server validates the string against the value bound from configuration and, on match, executes cache invalidation logic. Repeated requests amplify database load. Refer to the published proof-of-concept script and the VulnCheck advisory for full technical detail.

// No verified exploitation code is reproduced here.
// See the VulnCheck advisory and the referenced PoC repository for details.

Detection Methods for CVE-2026-90940

Indicators of Compromise

• HTTP requests to paths containing cache/refresh on the novel-front service from unexpected source addresses.
• Repeated cache-invalidation events in application logs unaccompanied by administrator sessions.
• Spikes in database query volume that correlate with CacheController activity in application traces.

Detection Strategies

• Alert on any external or unauthenticated access to the cache/refresh URL pattern via web server, reverse proxy, or WAF logs.
• Correlate high-frequency hits on the cache refresh endpoint with backend database latency or connection pool saturation.
• Review the CacheController.java execution path in application logs for invocations that do not originate from an administrator IP allowlist.

Monitoring Recommendations

• Enable access logging on the front portal and forward events to a centralized log platform for pattern analysis.
• Establish baselines for cache refresh frequency and alert on deviations exceeding normal operational cadence.
• Monitor database CPU, query rate, and slow-query counts for anomalies that coincide with cache invalidation events.

How to Mitigate CVE-2026-90940

Immediate Actions Required

• Change the default cache-management password in application.yml to a long, unique, high-entropy value.
• Restrict network access to the cache/refresh endpoint using a reverse proxy allowlist or firewall rule limited to administrative sources.
• Audit historical access logs for prior calls to the cache refresh endpoint using the default password value.

Patch Information

No fixed release has been identified in the enriched data. The condition affects novel-plus through version 5.3.3 as documented in the GitHub release page and the VulnCheck advisory. Operators should monitor the novel-plus GitHub repository for an upstream fix and, in the interim, apply configuration hardening and network restrictions.

Workarounds

• Override the cache password property in application.yml or via environment variable before deployment.
• Block external access to /cache/refresh* at the reverse proxy or web application firewall layer.
• Introduce rate limiting on the cache refresh path to reduce the impact of repeated invocation attempts.
• Consider disabling the endpoint entirely in production if administrative cache refresh is not required.

# Example: block the vulnerable endpoint at an NGINX reverse proxy
location ~* /cache/refresh {
    deny all;
    return 403;
}