JWT Key Exposure in GO Admin Version 2.0.12 Affects Go-Admin Team
CVE-2022-42980

9.8CRITICAL

Key Information:

Vendor

Go-admin

Status
Go-admin
Vendor
CVE Published:
17 October 2022

What is CVE-2022-42980?

A security flaw exists in GO Admin version 2.0.12, where the application utilizes the same string 'go-admin' as its production JWT key. This practice can lead to significant vulnerabilities, allowing unauthorized individuals to forge valid JWTs, potentially compromising the security of user sessions and sensitive data.

References

https://github.com/go-admin-team/go-admin/issues/716

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.