CRMEB CVE-2025-11290

Exploitation requires that the CRMEB JWT HMAC Secret Handler is active and the secret parameter is set to its default value. The specific default value must be known or discoverable (e.g., hardcoded in source code, documentation, or public examples). The application must accept and validate JWT tokens without additional security controls (e.g., token pinning, issuer verification, or out-of-band confirmation). Non-default secret configurations, custom JWT implementations, or deployments that disable JWT authentication are not affected. The high attack complexity (AC:H) likely reflects the need to either locate and confirm the exact default secret value or identify a specific code path that triggers its use, rather than generic network access.

CVSS score of 2.9 (low severity) paired with AC:H (high attack complexity) and EPSS of 0.04% (11th percentile) indicates this is a low-probability threat in terms of widespread exploitation likelihood. However, several factors elevate practical risk: (1) Public exploit code exists, reducing barrier to targeted attacks; (2) The vendor did not respond to disclosure, suggesting no patch timeline; (3) JWT forgery directly enables authentication bypass, which has high technical impact (VI:L); (4) The AC:H rating may reflect difficulty in discovering the exact default value or triggering condition, not fundamental complexity of the attack itself. This is a 'niche but real' vulnerability - unlikely to be mass-exploited but dangerous for organizations running CRMEB with JWT-based authentication visible to attackers. No KEV (CISA KEV) confirmation is available, indicating no confirmed active exploitation at scale. Threat level is moderate for CRMEB users, especially those with exposed JWT endpoints.

An attacker discovers that CRMEB's JWT handler uses a hard-coded or default secret (e.g., 'secret', 'crmeb_default', or similar). Using publicly available exploit code, the attacker crafts a valid JWT token with admin claims and sends it to the application's authentication endpoint. The token passes validation because the application uses the same default secret, allowing the attacker to bypass login and access administrative functions.