GitHub Advisoryadvisory · Go

GHSA-2hfh-94w5-wxvf ZPan Uses Hard-Coded Password

LOW Published 2025-07-11 Modified 2026-07-16 Official page ↗
Aliases
CVE-2025-7453
Ecosystem
Go
Packages
github.com/saltbo/zpan
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-259
Reviewed
2026-07-16

Affected packages

• Go github.com/saltbo/zpan: < 1.6.6 → fixed in 1.6.6

Description

A vulnerability was found in saltbo zpan up to 1.6.5/1.7.0-beta2. It has been rated as problematic. This issue affects the function NewToken of the file zpan/internal/app/service/token.go of the component JSON Web Token Handler. The manipulation with the input 123 leads to use of hard-coded password. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

Related

Alias · CVE (1)

  • CVE-2025-7453 A vulnerability was found in saltbo zpan up to 1.6.5/1.7.0-beta2. vulnerability

Weakness · CWE (1)

  • CWE-259 Use of Hard-coded Password weakness

References