GitHub Advisoryadvisory · Maven

GHSA-48cg-9c55-j2q7 hippo4j Includes Hard Coded Secret Key in JWT Creation

HIGH Published 2025-08-21 Modified 2025-08-22 Official page ↗
Aliases
CVE-2025-51606
Ecosystem
Maven
Packages
cn.hippo4j:hippo4j-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-798
Reviewed
2025-08-22

Affected packages

• Maven cn.hippo4j:hippo4j-core: >= 1.0.0, <= 1.5.0 (no fix yet)

Description

hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical security risk in systems where authentication and authorization rely on the integrity of JWTs.

Related

Alias · CVE (1)

  • CVE-2025-51606 hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. vulnerability

Weakness · CWE (1)

  • CWE-798 Use of Hard-coded Credentials weakness

References