| Название | rachelos WeRSS WeRSS<=1.4.8 Weak Authentication |
|---|
| Описание | WeRSS(https://github.com/rachelos/we-mp-rss/) uses hardcoded weak default JWT secret keys, and the default key in the configuration file is also predictable (project name). Attackers can use these default keys to forge valid administrator tokens, completely bypassing authentication
detail:https://www.notion.so/WeRSS-Weak-JWT-Key-Leading-to-Authentication-Bypass-2feea92a3c41803faadae58327facd7b |
|---|
| Источник | ⚠️ https://www.notion.so/WeRSS-Weak-JWT-Key-Leading-to-Authentication-Bypass-2feea92a3c41803faadae58327facd7b |
|---|
| Пользователь | din4 (UID 50867) |
|---|
| Представление | 05.02.2026 08:57 (8 месяцы назад) |
|---|
| Модерация | 08.02.2026 09:30 (3 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 344932 [rachelos WeRSS we-mp-rss до 1.4.8 JWT core/auth.py SECRET_KEY раскрытие информации] |
|---|
| Баллы | 16 |
|---|