Refly
Monthly
Refly through 1.1.0 uses a hard-coded JWT signing secret in apps/api/src/modules/config/app.config.ts, allowing unauthenticated remote attackers to forge authentication tokens and impersonate any user when deployments retain the default 'test' secret. Publicly available exploit code exists, and the vendor did not respond to the disclosure. The configuration is the limiting factor: operators who override the JWT secret with a strong environment-provided value are not exploitable.
Refly through 1.1.0 uses a hard-coded JWT signing secret in apps/api/src/modules/config/app.config.ts, allowing unauthenticated remote attackers to forge authentication tokens and impersonate any user when deployments retain the default 'test' secret. Publicly available exploit code exists, and the vendor did not respond to the disclosure. The configuration is the limiting factor: operators who override the JWT secret with a strong environment-provided value are not exploitable.