JWT Signing Vulnerability in Litmus Platform by Litmus
CVE-2025-14261

7.1HIGH

Key Information:

Vendor

Litmuschaos

Status
Litmus
Vendor
CVE Published:
8 December 2025

What is CVE-2025-14261?

The Litmus platform has a significant vulnerability in its implementation of JSON Web Tokens (JWT) for authentication and authorization. The core issue arises from the use of a signing secret that is merely 6 bytes long, rendering it highly susceptible to cracking attempts. This weakness can potentially allow attackers to exploit the authentication process, gaining unauthorized access to the system and compromising sensitive data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

litmus 0 < 3.23.0

References

https://research.jfrog.com/vulnerabilities/litmus-jwt-mis...
third-party-advisory
https://github.com/litmuschaos/litmus/pull/5324
patch

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.