CVE-2026-42869
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
CWE-287
Autenticación incorrecta
Fecha de publicación:
11/05/2026
Última modificación:
12/05/2026
Descripción
*** Pendiente de traducción *** SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57, SOCFortress CoPilot ships a hardcoded JWT signing secret as a fallback value in backend/app/auth/utils.py:28 and ships it verbatim in .env.example. Any deployment where JWT_SECRET is not explicitly set — including the default Docker Compose setup — signs all authentication tokens with this publicly known value. An unauthenticated attacker can forge arbitrary admin-scoped JWTs and gain full control of the application and every security tool it manages without any credentials. This vulnerability is fixed in 0.1.57.
Impacto
Puntuación base 3.x
10.00
Gravedad 3.x
CRÍTICA