| शीर्षक | rachelos WeRSS WeRSS<=1.4.8 Weak Authentication |
|---|
| विवरण | WeRSS(https://github.com/rachelos/we-mp-rss/) uses hardcoded weak default JWT secret keys, and the default key in the configuration file is also predictable (project name). Attackers can use these default keys to forge valid administrator tokens, completely bypassing authentication
detail:https://www.notion.so/WeRSS-Weak-JWT-Key-Leading-to-Authentication-Bypass-2feea92a3c41803faadae58327facd7b |
|---|
| स्रोत | ⚠️ https://www.notion.so/WeRSS-Weak-JWT-Key-Leading-to-Authentication-Bypass-2feea92a3c41803faadae58327facd7b |
|---|
| उपयोगकर्ता | din4 (UID 50867) |
|---|
| सबमिशन | 05/02/2026 08:57 AM (8 महीनों पहले) |
|---|
| संयम | 08/02/2026 09:30 AM (3 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 344932 [rachelos WeRSS we-mp-rss तक 1.4.8 JWT core/auth.py SECRET_KEY सूचना का प्रकटीकरण] |
|---|
| अंक | 16 |
|---|