Hard-coded ArchiverSpaApi JWT Signing Key
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.3%
exploitation probability
0.3%top 75% of all CVEs
observed exploitation
nono source reports it
In short
The ArchiverSpaApi application uses a fixed JWT signing key that anyone can discover. An attacker can create fake login tokens to access protected features without having a real account.
Technical detail
The application employs a hard-coded JWT signing key, allowing an unauthenticated remote attacker to forge valid JWT tokens and gain unauthorized access to protected endpoints. The vulnerability stems from insufficient key management (CWE-798) and requires no authentication as a pre-condition; impact includes unauthorized data access and potential privilege escalation.
Summary generated and translated by AI from the official description.
The ArchiverSpaApi ASP.NET application uses a hard-coded JWT signing key. An unauthenticated remote attacker can generate and use a verifiable JWT token to access protected ArchiverSpaApi URL endpoints.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
GFI · Archiver