MartialBE one-hub CVE-2025-14651

Q: What is the CVSS score of CVE-2025-14651?

CVE-2025-14651 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Key Management Errors (CWE-320)

2025-12-14 cna@vuldb.com

Docker Information Disclosure

2.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:46 vuln.today

DescriptionCVE.org

A vulnerability has been found in MartialBE one-hub up to 0.14.27. This vulnerability affects unknown code of the file docker-compose.yml. The manipulation of the argument SESSION_SECRET leads to use of hard-coded cryptographic key . The attack may be initiated remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. The code maintainer recommends (translated from Chinese): "The default docker-compose example file is not recommended for production use. If you intend to use it in production, please carefully check and modify every configuration and environment variable yourself!"

AnalysisAI

MartialBE one-hub up to version 0.14.27 uses a hard-coded cryptographic key in the SESSION_SECRET environment variable of its default docker-compose.yml configuration, allowing remote attackers to potentially decrypt or forge session tokens with high attack complexity. The vulnerability requires non-standard deployment configurations and affects confidentiality rather than integrity or availability. Exploit code has been disclosed publicly, though active exploitation remains unconfirmed by CISA, and the vendor explicitly recommends against using the default Docker Compose example in production environments.

Technical ContextAI

The vulnerability stems from CWE-320 (Use of Insufficiently Random Values) in cryptographic key management. MartialBE one-hub is a Docker-based application that relies on a SESSION_SECRET environment variable for session token generation and validation in its default docker-compose.yml configuration file. The default example includes a hard-coded, static session secret (visible at the referenced GitHub line) that is typically insufficient entropy for production cryptographic use. When this default configuration is deployed without modification, all instances share identical session secrets, enabling attackers with knowledge of the hard-coded value to forge valid session tokens or decrypt session data. The attack surface is specific to deployments using the provided Docker Compose example without customization, as the code maintainer emphasizes this template is not intended for production use.

Affected ProductsAI

MartialBE one-hub versions up to and including 0.14.27 are affected when deployed using the default docker-compose.yml configuration file without modification to the SESSION_SECRET environment variable. The vulnerable configuration is documented in the official GitHub repository at github.com/MartialBE/one-hub. No CPE string was provided in available sources. The issue was first reported in GitHub issue #872 and acknowledged by the code maintainer.

RemediationAI

The primary mitigation is to immediately update MartialBE one-hub to the latest available version and generate a unique, cryptographically strong SESSION_SECRET value (minimum 32 random bytes) via environment variable configuration rather than relying on defaults. Organizations currently running versions 0.14.27 or earlier must replace the default SESSION_SECRET with a custom value using a secure random generator (e.g., openssl rand -hex 32 on Linux/macOS or equivalent tools). The vendor's GitHub repository includes updated examples and documentation recommending against production use of the default docker-compose.yml template. For existing deployments, rotate all active session tokens after updating the SESSION_SECRET to invalidate any tokens generated with the old hard-coded value. If session persistence across deployments is required, document and secure the custom SESSION_SECRET in a secrets management system (e.g., Docker Secrets, Kubernetes Secrets, or HashiCorp Vault) rather than committing it to version control. Review deployment documentation and process controls to prevent future use of example configurations in production. References: github.com/MartialBE/one-hub/issues/872 and the official repository documentation.