-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from a hardcoded JWT secret key in the application.yml configuration file (lin.cms.token-secret), not from specific code functions. While JWT-related functions would inherently be vulnerable due to using this static secret, no specific functions are explicitly mentioned in the provided vulnerability details. The root cause is the exposure through a misconfigured resource (CWE-668) rather than vulnerable code logic. The advisory directly references the configuration line but doesn't identify concrete functions in the codebase, making function-level attribution speculative without additional code context.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.github.talelin:lin-cms-core | maven | <= 0.2.1 |