CVE-2025-35940: high-severity vulnerability in GFI Archiver
Hard-coded ArchiverSpaApi JWT Signing Key
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The ArchiverSpaApi application uses a fixed JWT signing key that anyone can discover. An attacker can create fake login tokens to access protected features without having a real account.
The application employs a hard-coded JWT signing key, allowing an unauthenticated remote attacker to forge valid JWT tokens and gain unauthorized access to protected endpoints. The vulnerability stems from insufficient key management (CWE-798) and requires no authentication as a pre-condition; impact includes unauthorized data access and potential privilege escalation.
In the same product, most dangerous first.