| शीर्षक | zhistaredu 3.8.1 Use of Hard-coded Password |
|---|
| विवरण | 产品：StarTraining 3.8.1
漏洞：JWT 硬编码密钥可伪造身份令牌
摘要：`application.yml` sets `token.secret` to a fixed 26-char string. `UserLoginService.createToken()` signs HS512 JWT without `exp`. Attacker can forge tokens for arbitrary `user_id` / `company_id`.
影响：Full API access as any user when secret is unchanged.
修复：Rotate secret via env; add exp/iat claims; remove debug println of secret/token.
|
|---|
| स्रोत | ⚠️ https://github.com/ArrestX/startraining-advisories/blob/main/advisories/ST-VULN-001-jwt-hardcoded-secret-forge.md |
|---|
| उपयोगकर्ता | Vseen (UID 99867) |
|---|
| सबमिशन | 03/08/2026 02:17 AM (2 महीनों पहले) |
|---|
| संयम | 25/09/2026 10:57 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 409898 [zhistaredu StarTraining तक 3.8.1 JWT Token application.yml UserLoginService.createToken user_id/company_id कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|