Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2025-14261

Lack of entropy allows registered low-privileged users of Litmus to crack valid JWT tokens and gain admin privileges

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
JFROG

Description

The Litmus platform uses JWT for authentication and authorization, but the secret being used for signing the JWT is only 6 bytes long at its core, which makes it extremely easy to crack.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Litmuschaos litmus

Default version status: unaffected

  • 0 to < 3.23.0affected

References