CVEvulnerability

CVE-2025-41702

9.8 CRITICAL Published 2025-08-26 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2025-08-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-321

Description

The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.

Related

Weakness · CWE (1)

  • CWE-321 Use of Hard-coded Cryptographic Key weakness

References