GHSA-vf78-3q9f-92g3 is a critical-severity (CVSS 10) Hard-coded Credentials vulnerability in org.folio:mod-data-export-spring. O3 Security confirms whether GHSA-vf78-3q9f-92g3 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Hard-coded System User Credentials in Folio Data Export Spring module
Real-World Exposure
org.folio:mod-data-export-spring☕org.folio:mod-data-export-springReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Impact
The module creates a system user that is used to perform internal module-to-module operations. Credentials for this user are hard-coded in the source code. This makes it trivial to authenticate as this user, resulting in unauthorized access to potentially dangerous APIs, allowing to view and modify configuration including single-sign-on configuration, to read, add and modify user data, and to read and transfer fees/fines in a patron's account.
Patches
Upgrade mod-data-export-spring to >=2.0.2, or a 1.5.x version >=1.5.4.
Workarounds
No known workarounds.
References
https://wiki.folio.org/x/hbMMBw - FOLIO Security Advisory with Upgrade Instructions https://github.com/folio-org/mod-data-export-spring/commit/93aff4566bff59e30f4121b5a2bda5b0b508a446 - Fix
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.folio:mod-data-export-spring | ≥ 2.0.0&&< 2.0.2 | 2.0.2 |
| ☕Maven | org.folio:mod-data-export-spring | all versions | 1.5.4 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.folio:mod-data-export-spring. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update org.folio:mod-data-export-spring to 2.0.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-vf78-3q9f-92g3 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-vf78-3q9f-92g3 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-vf78-3q9f-92g3. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-vf78-3q9f-92g3 in your dependencies?
O3 detects GHSA-vf78-3q9f-92g3 across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.