-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the use of a hard-coded secret for JWT token validation in the actiontech/sqle repository. The file sqle/utils/jwt.go defines a global variable JWTSecretKey with a default value of "secret". This key is used by the functions ParseAuditPlanName and GetUserNameFromJWTToken to verify the integrity of incoming JWTs. Because this secret is publicly known, an attacker can easily forge JWT tokens and sign them with the same secret. These forged tokens will be considered valid by the application, allowing the attacker to impersonate other users and gain unauthorized access to protected resources. The analysis of the issue and the provided source code confirms that any function relying on JWTSecretKey for token validation is vulnerable.
utils.ParseAuditPlanNamesqle/utils/jwt.go
utils.GetUserNameFromJWTTokensqle/utils/jwt.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/actiontech/sqle | go | <= 4.2511.0 |