| Название | https://github.com/MartialBE https://github.com/MartialBE/one-hub ≤ v0.14.27 Authentication Bypass by Primary Weakness |
|---|
| Описание | Because the one-hub system uses Docker's one-click deployment feature, many operations and maintenance personnel directly use the default open-source session key. This allows attackers to easily forge JWTs and gain important system administrator privileges, including but not limited to obtaining sensitive data, adding and deleting users, and accessing OSS cloud keys. This poses a significant threat. |
|---|
| Источник | ⚠️ https://github.com/MartialBE/one-hub/issues/872 |
|---|
| Пользователь | 28Hus (UID 92415) |
|---|
| Представление | 09.12.2025 15:05 (5 месяцы назад) |
|---|
| Модерация | 13.12.2025 10:15 (4 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 336384 [MartialBE one-hub до 0.14.27 docker-compose.yml SESSION_SECRET слабое шифрование] |
|---|
| Баллы | 19 |
|---|