CVE-2025-35940
Hard-coded ArchiverSpaApi JWT Signing Key
In short
The ArchiverSpaApi application uses a fixed JWT signing key that anyone can discover. An attacker can create fake login tokens to access protected features without having a real account.
Technical detail
The application employs a hard-coded JWT signing key, allowing an unauthenticated remote attacker to forge valid JWT tokens and gain unauthorized access to protected endpoints. The vulnerability stems from insufficient key management (CWE-798) and requires no authentication as a pre-condition; impact includes unauthorized data access and potential privilege escalation.
Summary generated and translated by AI from the official description.
The ArchiverSpaApi ASP.NET application uses a hard-coded JWT signing key. An unauthenticated remote attacker can generate and use a verifiable JWT token to access protected ArchiverSpaApi URL endpoints.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
GFI · ArchiverWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →