CyberRota Analysis
AI-GeneratedA vulnerability exists in the JWT Signing component of Lybbn Django-Vue-Lyadmin versions up to 3.2.12, where manipulation of the SECRET_KEY argument can lead to the use of a hard-coded cryptographic key. This flaw allows for potential remote exploitation, posing a significant risk to applications that have not updated their keys before deployment. Developers and organizations using this framework should prioritize immediate remediation to mitigate the risk of unauthorized access and data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key . Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project maintainer explains: "The issue with this key is described in the documentation. Developers need to manually change their keys before deployment."