CVE-2025-8974: linlinjava litemall JSON Web Token JwtHelper.java hard-coded credentials
A vulnerability was determined in linlinjava litemall up to 1.8.0. Affected by this issue is some unknown functionality of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/util/JwtHelper.java of the component JSON Web Token Handler. The manipulation of the argument SECRET with the input X-Litemall-Token leads to hard-coded credentials. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8974?
CVE-2025-8974 has been assessed with a medium severity rating due to potential impacts on security through improper handling of JSON Web Tokens.
How do I fix CVE-2025-8974?
To mitigate CVE-2025-8974, upgrade linlinjava litemall to version 1.8.1 or later, as these versions contain patches for this vulnerability.
What vulnerability affects linlinjava litemall up to version 1.8.0?
CVE-2025-8974 affects linlinjava litemall versions up to 1.8.0, impacting the JSON Web Token Handler component.
What components are impacted by CVE-2025-8974?
CVE-2025-8974 specifically impacts the JwtHelper.java file within the litemall-wx-api component of linlinjava litemall.
What could an attacker potentially exploit in CVE-2025-8974?
An attacker could exploit CVE-2025-8974 to manipulate JSON Web Token arguments, potentially leading to unauthorized access or data exposure.