Hard-Coded Credentials in dromara orion-visor API Exposure

A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Casky was already ahead

This CVE exploits attack patterns that Casky's 233matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-90509 exposes a critical credential management flaw in dromara orion-visor versions up to 2.5.7, where hard-coded credentials are embedded in the ExposeApiAspect component. This vulnerability allows unauthenticated remote attackers to discover and abuse legitimate system credentials, bypassing authentication mechanisms entirely. Organizations deploying orion-visor—a popular open-source administrative framework—face immediate risk of unauthorized system access, data exfiltration, and lateral movement within their infrastructure. The public disclosure of exploit code significantly accelerates threat adoption, making this a high-priority remediation target despite the lack of current CISA KEV designation.

Casky's 233 mapped skills address the credential discovery and abuse patterns underlying TA0006 (Credential Access) techniques. Practitioners using Casky's Claude-powered analysis will identify detection signals including: suspicious API calls to ExposeApiAspect endpoints, anomalous authentication patterns using default or hard-coded credential sets, and unusual privilege escalation attempts following initial API exploitation. The platform's extended reasoning capability correlates CWE-259 (Use of Hard-Coded Password) and CWE-798 (Use of Hard-Coded Credentials) indicators with behavioral anomalies—such as lateral movement using discovered credentials or repeated failed access attempts with specific credential patterns—enabling security teams to distinguish legitimate traffic from exploitation attempts and prioritize response efforts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

233 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-90509.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0006

Investigate the attack patterns behind CVE-2026-90509

Casky has 233 skills that investigate the attack patterns behind CVE-2026-90509. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn