Improper Access Control in LollMS Application by Parisneo

CVE-2026-1114

What is CVE-2026-1114?

The LollMS application developed by Parisneo has a security vulnerability in its session management system. In version 2.1.0, the application employs a weak secret key for signing JSON Web Tokens (JWT). This weakness allows attackers to execute offline brute-force attacks aimed at discovering the secret key. With access to the secret, an attacker can craft forged administrative tokens by altering the JWT payload and signing it with the compromised secret key. This exploitation leads to privilege escalation, where unauthorized individuals can impersonate administrators and access protected endpoints. The issue has been rectified in version 2.2.0.

References