macrozheng mall JWT Token default key

The macrozheng mall application uses a default encryption key for JWT tokens, which means an attacker who knows this key could potentially forge authentication tokens. While exploitation is difficult and requires specific knowledge, it undermines the security of user authentication.

The JWT Token Handler in macrozheng mall versions up to 1.0.3 relies on a hardcoded default cryptographic key for token generation and validation (CWE-1394). An attacker with knowledge of the default key and high technical complexity can forge valid JWT tokens to bypass authentication mechanisms, though practical exploitation remains challenging due to additional attack constraints.