Django Vue Lyadmin
Monthly
Hard-coded JWT signing key in Lybbn Django-Vue-Lyadmin through version 3.2.12 allows remote attackers who know the publicly documented default SECRET_KEY in backend/application/settings.py to forge valid JSON Web Tokens, impersonating arbitrary users and bypassing authentication (CWE-321). Publicly available exploit code exists, but exposure is context-dependent: the maintainer states the key is documented and must be changed manually before deployment, so any instance that rotated SECRET_KEY to a private value is not affected. Our independent assessment rates this CVSS 3.1 9.1 (network-reachable, no authentication or user interaction required against an unremediated instance) versus the CVSS 4.0 5.5 recorded by VulDB, but the decisive limiting factor is operator configuration rather than attacker capability.
Hard-coded JWT signing key in Lybbn Django-Vue-Lyadmin through version 3.2.12 allows remote attackers who know the publicly documented default SECRET_KEY in backend/application/settings.py to forge valid JSON Web Tokens, impersonating arbitrary users and bypassing authentication (CWE-321). Publicly available exploit code exists, but exposure is context-dependent: the maintainer states the key is documented and must be changed manually before deployment, so any instance that rotated SECRET_KEY to a private value is not affected. Our independent assessment rates this CVSS 3.1 9.1 (network-reachable, no authentication or user interaction required against an unremediated instance) versus the CVSS 4.0 5.5 recorded by VulDB, but the decisive limiting factor is operator configuration rather than attacker capability.