CVE-2025-55449: AstrBot is vulnerable to RCE with hard-coded JWT signing keys

The vulnerability stems from a hard-coded JWT signing key, WEBUI_SK, which was defined in astrbot/core/__init__.py. This static, publicly known key was used to both sign and verify authentication tokens. The function Auth.generate_jwt used this key to create tokens, while the DashboardServer.auth_middleware function used the same key to validate tokens for protected routes. An attacker could leverage this knowledge to generate their own valid token, bypassing authentication entirely. Once authenticated, they could access sensitive functionality, such as the plugin installation endpoint mentioned in the vulnerability description, to achieve remote code execution. The patch remediates this by removing the hard-coded key and implementing a system where a unique, random JWT secret is generated and stored in the application's configuration upon first run.