CVE-2026-85391: Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Peppermint versions through 0.5.5 are affected when they use the hardcoded JWT signing secret present in docker-compose.yml. The provided data does not identify any configuration-specific exception.
What does an attacker need to exploit this issue?
An attacker does not need credentials or user interaction. They can use the published signing secret to create valid session tokens for arbitrary user IDs and access protected endpoints.
What level of access can a forged token provide?
A forged token can impersonate any account because the attacker can mint tokens for arbitrary user IDs. This enables access to protected endpoints without legitimate credentials.