CVE-2025-51606: High severity Hippo4j Hippo4j vulnerability
hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical security risk in systems where authentication and authorization rely on the integrity of JWTs.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-51606?
CVE-2025-51606 is classified as a critical vulnerability due to the potential for user impersonation and unauthorized access.
How do I fix CVE-2025-51606?
To fix CVE-2025-51606, update Hippo4j to version 1.5.1 or later where the hard-coded secret key issue is addressed.
What systems are affected by CVE-2025-51606?
CVE-2025-51606 affects Hippo4j versions from 1.0.0 to 1.5.0, including the hippo4j-core package.
Can CVE-2025-51606 lead to data breaches?
Yes, CVE-2025-51606 can lead to data breaches by allowing attackers to create valid access tokens and impersonate users.
Is it safe to use Hippo4j version 1.5.0 after discovering CVE-2025-51606?
No, using Hippo4j version 1.5.0 is unsafe due to the presence of CVE-2025-51606; an upgrade is necessary.