The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.
                
            Metrics
Affected Vendors & Products
References
        | Link | Providers | 
|---|---|
| https://certvde.com/de/advisories/VDE-2025-076 | 
                     | 
            
History
                    Wed, 27 Aug 2025 11:45:00 +0000
| Type | Values Removed | Values Added | 
|---|---|---|
| First Time appeared | 
        
        Welotec
         Welotec egos Webgui  | 
|
| Vendors & Products | 
        
        Welotec
         Welotec egos Webgui  | 
Tue, 26 Aug 2025 20:15:00 +0000
| Type | Values Removed | Values Added | 
|---|---|---|
| Metrics | 
        
        ssvc
         
  | 
Tue, 26 Aug 2025 06:15:00 +0000
| Type | Values Removed | Values Added | 
|---|---|---|
| Description | The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key. | |
| Title | egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass | |
| Weaknesses | CWE-321 | |
| References | 
         | |
| Metrics | 
        
        cvssV3_1
         
  | 
Status: PUBLISHED
Assigner: CERTVDE
Published: 2025-08-26T06:10:57.464Z
Updated: 2025-08-26T19:39:00.393Z
Reserved: 2025-04-16T11:17:48.310Z
Link: CVE-2025-41702
Updated: 2025-08-26T19:38:55.532Z
Status : Awaiting Analysis
Published: 2025-08-26T06:15:32.923
Modified: 2025-08-26T13:41:58.950
Link: CVE-2025-41702
No data.