-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.seatunnel:seatunnel-web | maven | < 1.0.1 | 1.0.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the hardcoded JWT secretKey in application.yml. While specific function names are not explicitly provided in the commit or descriptions, the presence of a static secret in the configuration directly impacts all JWT-related functions that rely on this key. The commit fixes this by removing the hardcoded value, confirming that the key's presence in the configuration enabled the exploit. Standard JWT implementations use the secretKey for token signing/validation, so any functions handling these operations would inherit the vulnerability.
Ongoing coverage of React2Shell