| 标题 | rachelos WeRSS WeRSS<=1.4.8 Weak Authentication |
|---|
| 描述 | WeRSS(https://github.com/rachelos/we-mp-rss/) uses hardcoded weak default JWT secret keys, and the default key in the configuration file is also predictable (project name). Attackers can use these default keys to forge valid administrator tokens, completely bypassing authentication
detail:https://www.notion.so/WeRSS-Weak-JWT-Key-Leading-to-Authentication-Bypass-2feea92a3c41803faadae58327facd7b |
|---|
| 来源 | ⚠️ https://www.notion.so/WeRSS-Weak-JWT-Key-Leading-to-Authentication-Bypass-2feea92a3c41803faadae58327facd7b |
|---|
| 用户 | din4 (UID 50867) |
|---|
| 提交 | 2026-02-05 08時57分 (8 月前) |
|---|
| 管理 | 2026-02-08 09時30分 (3 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 344932 [rachelos WeRSS we-mp-rss 直到 1.4.8 JWT core/auth.py SECRET_KEY 信息公开] |
|---|
| 积分 | 16 |
|---|