The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.
Metrics
Affected Vendors & Products
References
Link | Providers |
---|---|
https://certvde.com/de/advisories/VDE-2025-076 |
![]() ![]() |
History
Wed, 27 Aug 2025 11:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Welotec
Welotec egos Webgui |
|
Vendors & Products |
Welotec
Welotec egos Webgui |
Tue, 26 Aug 2025 20:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Tue, 26 Aug 2025 06:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key. | |
Title | egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass | |
Weaknesses | CWE-321 | |
References |
| |
Metrics |
cvssV3_1
|

Status: PUBLISHED
Assigner: CERTVDE
Published: 2025-08-26T06:10:57.464Z
Updated: 2025-08-26T19:39:00.393Z
Reserved: 2025-04-16T11:17:48.310Z
Link: CVE-2025-41702

Updated: 2025-08-26T19:38:55.532Z

Status : Awaiting Analysis
Published: 2025-08-26T06:15:32.923
Modified: 2025-08-26T13:41:58.950
Link: CVE-2025-41702

No data.