CVE-2024-11619: low-severity vulnerability in macrozheng mall
macrozheng mall JWT Token default key
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The macrozheng mall application uses a default encryption key for JWT tokens, which means an attacker who knows this key could potentially forge authentication tokens. While exploitation is difficult and requires specific knowledge, it undermines the security of user authentication.
The JWT Token Handler in macrozheng mall versions up to 1.0.3 relies on a hardcoded default cryptographic key for token generation and validation (CWE-1394). An attacker with knowledge of the default key and high technical complexity can forge valid JWT tokens to bypass authentication mechanisms, though practical exploitation remains challenging due to additional attack constraints.
In the same product, most dangerous first.