LoLLMs CVE-2026-1114

Upgrade immediately to LoLLMs version 2.2.0 or later, which resolves the weak JWT secret issue per commit a3b2b82b84d537a9da63e63a370a6a8ad55fed34 available at https://github.com/parisneo/lollms/commit/a3b2b82b84d537a9da63e63a370a6a8ad55fed34. The patch replaces the weak secret with a cryptographically secure randomly generated key. For environments where immediate upgrade is not feasible, implement the following compensating controls with noted limitations: (1) Manually regenerate the JWT secret in configuration files using a cryptographically secure random generator (32+ bytes, base64 encoded) and restart the application-this invalidates all existing tokens and requires user re-authentication but does not address the underlying weak default, so validate the new secret meets NIST SP 800-132 guidelines for key derivation; (2) Deploy network segmentation to restrict LoLLMs administrative endpoints to trusted IP ranges only via firewall rules or reverse proxy ACLs-reduces attack surface but does not prevent exploitation by insider threats or compromised trusted networks; (3) Implement additional authentication layers such as mutual TLS or API gateway tokens in front of LoLLMs-adds defense in depth but introduces latency and operational complexity. Note that rotating secrets alone is insufficient if the application redeploys with the same weak default on next restart. Advisory available at https://huntr.com/bounties/608b2a3b-2225-438e-9e61-ffbfdec2ed89.