Peppermint CVE-2026-85391

Requires that the target Peppermint deployment (through 0.5.5) still uses the hardcoded JWT signing secret from the shipped docker-compose.yml - i.e., the operator did not override it with a custom environment value. Given that condition, exploitation is remote, unauthenticated, requires no user interaction, and works against default configurations: the attacker only needs network reachability to the API and the publicly known secret to forge tokens for any user ID. The primary limiting factor is deployment hardening - instances that set a unique random JWT secret are not exploitable.

This is a genuine high-priority issue for exposed instances. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) is consistent with the description: fully remote, no authentication, no user interaction, and complete compromise of confidentiality and integrity by forging admin tokens. No EPSS score, KEV entry, or public PoC is provided; the vulnerability is not listed in CISA KEV and there is no confirmation of active exploitation. The most important caveat is a configuration dependency the CVSS does not capture: exploitation only works if the operator left the docker-compose default secret in place. Deployments that override the JWT secret via environment variable are not affected, so real-world exposure hinges on operator hygiene rather than being universal. Weighing signals: the technical impact is severe and trivially automatable against default installs, but the affected product is niche and the vulnerable condition is avoidable, so treat internet-exposed default deployments as urgent and hardened/overridden ones as not affected.

An attacker locates an internet-exposed Peppermint instance still using the default docker-compose configuration, retrieves the public JWT signing secret from the project's docker-compose.yml, and locally signs a JWT asserting an administrator user ID. They present this forged token to the API and gain full authenticated access to tickets, user data, and admin functions without ever knowing a password. No published exploit tool is needed - the secret itself is the exploit.