The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.
Metrics
Affected Vendors & Products
References
| Link | Providers |
|---|---|
| https://certvde.com/de/advisories/VDE-2025-076 |
|
History
Wed, 27 Aug 2025 11:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Welotec
Welotec egos Webgui |
|
| Vendors & Products |
Welotec
Welotec egos Webgui |
Tue, 26 Aug 2025 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 26 Aug 2025 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key. | |
| Title | egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass | |
| Weaknesses | CWE-321 | |
| References |
| |
| Metrics |
cvssV3_1
|
Status: PUBLISHED
Assigner: CERTVDE
Published: 2025-08-26T06:10:57.464Z
Updated: 2025-08-26T19:39:00.393Z
Reserved: 2025-04-16T11:17:48.310Z
Link: CVE-2025-41702
Updated: 2025-08-26T19:38:55.532Z
Status : Awaiting Analysis
Published: 2025-08-26T06:15:32.923
Modified: 2025-08-26T13:41:58.950
Link: CVE-2025-41702
No data.
ReportizFlow