JWT Token Vulnerability in Dpanel Docker Management System
CVE-2025-30206

9.8CRITICAL

Key Information:

Vendor

Donknap

Status
Dpanel
Vendor
CVE Published:
15 April 2025

What is CVE-2025-30206?

The Dpanel Docker visualization panel system is affected by a vulnerability due to a hardcoded JSON Web Token (JWT) secret in its default settings. This flaw allows attackers to generate valid JWT tokens, thereby bypassing authentication mechanisms. By extracting the hardcoded secret from the source code, attackers can impersonate privileged users, gain unauthorized administrative access, and exert full control over the host machine. Such access can lead to serious repercussions, including exposure of sensitive data, unauthorized command execution, and potential privilege escalation. To mitigate this issue, users are advised to upgrade to Dpanel version 1.6.1, which addresses the vulnerability, and implement secure configuration practices by replacing the hardcoded secret with a securely generated value.

Affected Version(s)

dpanel < 1.6.1

References

https://github.com/donknap/dpanel/security/advisories/GHS...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.