| tiêu đề | lanyulei ferry <= 1.0.0 Authentication Bypass by Primary Weakness |
|---|
| Mô tả | ferry 1.0.0 and earlier validate session tokens with a JWT signing key that is either empty or left at the hard-coded factory default. An unauthenticated attacker who knows the token layout can mint a token carrying "rolekey": "admin" and an arbitrary future exp; the server accepts it as a fully privileged session.
The impact is amplified by the authorization design: the Casbin enforcer takes its subject directly from the rolekey claim inside the token and never re-reads the user's role from the database. Forging that one claim is therefore equivalent to holding the administrator role.
Because the same empty/default key also works across independent deployments of the product, this is a product-level defect rather than a single-site misconfiguration, and it can be mass-exploited via a search-engine fingerprint. |
|---|
| Nguồn | ⚠️ https://github.com/liumiya63-arch/CVE/blob/main/ferry-CVE-en-20261018/CVE-ferry-jwt-auth-bypass.md |
|---|
| Người dùng | liumiya (UID 102169) |
|---|
| Đệ trình | 18/10/2026 10:28 (cách đây 26 ngày) |
|---|
| Kiểm duyệt | 12/11/2026 18:35 (25 days later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 436447 [lanyulei ferry 1.0.0/1.0.0-beta.1 JWT Validation middleware/auth.go xác thực yếu] |
|---|
| điểm | 0 |
|---|