CVE-2025-41702: egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass
The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-41702?
The severity of CVE-2025-41702 is considered high due to the potential for unauthenticated remote attacks that compromise authentication mechanisms.
How do I fix CVE-2025-41702?
To fix CVE-2025-41702, you should remove the hard-coded JWT secret key from the egOS WebGUI backend and replace it with a secure, configurable key.
What is the impact of CVE-2025-41702?
The impact of CVE-2025-41702 allows attackers to bypass authentication and authorization by generating valid HS256 tokens.
Who is affected by CVE-2025-41702?
CVE-2025-41702 affects installations of the egOS WebGUI where the default user has access to the embedded JWT secret key.
Is CVE-2025-41702 an authenticated or unauthenticated vulnerability?
CVE-2025-41702 is an unauthenticated vulnerability, allowing remote attackers to exploit it without prior authentication.