CVE-2026-85391criticalCWE-798

CVE-2026-85391: fallo crítico en Peppermint-Lab peppermint

Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml

Publicada el

Seguir esta CVE+ Monitorear peppermint

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.3epss 0.6%
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Peppermint-Lab · peppermint
CVEs relacionadas — Peppermint-Lab peppermint

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-85392MEDIUMPeppermint through 0.5.5 Authorization Bypass on the User Logout EndpointEPSS 0.5%CVE-2026-111353MEDIUMPeppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload EndpointsEPSS 0.3%