Predictable JWT Secret Key in Vantage6 Open-Source Infrastructure
CVE-2025-43866

1.7LOW

Key Information:

Vendor

Vantage6

Status
Vantage6
Vendor
CVE Published:
12 June 2025

What is CVE-2025-43866?

Vantage6, an open-source infrastructure designed for privacy-preserving analysis, contains a vulnerability where the JWT secret key is auto-generated. By default, this key is created as a UUID1, which poses a risk due to its predictability. Attackers could potentially exploit this flaw to gain unauthorized access to sensitive information. This issue was addressed in the 4.11.0 release, highlighting the importance of using cryptographically secure key generation methods.

Affected Version(s)

vantage6 < 4.11

References

https://github.com/vantage6/vantage6/security/advisories/...
x_refsource_CONFIRM

CVSS V4

Score:
1.7
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.