CVE-2023-51840 is a use of a hard-coded cryptographic key in DoraCMS 2.1.8. The record rates it Critical at 9.8. The project's issue is titled Usage of Fixed Key. No fixed version is named, so check the project and replace the key in your deployment.
What's affected
DoraCMS 2.1.8. The record does not name a fixed version. The project's issue 262, titled Usage of Fixed Key, describes the concern.
Because the weakness is a key that ships with the software, every installation that did not change it shares the same secret.
The record gives a CVSS score of 9.8 (Critical). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. No account is needed. No user interaction is required. Impact on confidentiality is high, on integrity high, and on availability high. The weakness class is CWE-798.
How to check if you're exposed
Check the version in your package manifest, for example with grep version package.json in the project directory. Then search your configuration for any key or secret that was set by the project's defaults and never changed.
If you find that the key in use matches the one in the source, treat it as public.
What to do now
- Find DoraCMS installations and their versions.
- Read issue 262 and the project's releases for a fix.
- Replace any default or fixed key with a new random one stored outside the code.
- Invalidate sessions or tokens that were produced with the old key.
- Restrict admin interfaces to trusted networks.
Why it matters
A hard-coded key, CWE-798, is a secret written into the source. Anyone with the source, and for an open source project that is everyone, can learn it. If the key signs or encrypts anything that grants access, they can forge it.
That is why the score is 9.8, with no privileges and no interaction. The record does not detail what the key protects, so check the project's issue to see.
The fix for a fixed key is a unique key per installation. Even without a patch, you can often generate your own in configuration.
A short audit helps beyond this one product. Search your own repositories for keys, salts and secrets committed to source, and move them to environment variables or a secrets store. The same habit prevents this class of flaw in code your team writes.
Quick check
What is the weakness?
A cryptographic key that is part of the source code and the same for every installation.
Is there a fix?
None is named. Replace the key in your own deployment and check the project.
Sources
Last reviewed: 19 October 2026.
