CVE-2025-56749
BaseFortify
Publication date: 2025-10-15
Last updated on: 2025-10-21
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| creativeitem | academy_lms | to 6.14 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-56749 is a critical vulnerability in Creativeitem Academy LMS up to version 6.14 caused by the use of a hardcoded default JWT secret key. This secret key is static and identical across all default installations, allowing attackers to forge valid JWT tokens. By doing so, attackers can bypass authentication and gain unauthorized access to any user account, including administrator accounts. [1]
How can this vulnerability impact me? :
This vulnerability allows attackers to completely bypass authentication and escalate privileges by forging JWT tokens. As a result, unauthorized users can access sensitive user data, perform administrative functions, manage courses, and even handle payment processing through the API endpoints that rely on JWT authentication. This can lead to data breaches, loss of control over the system, and potential financial and reputational damage. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the system uses the default hardcoded JWT secret key in the file `lms/application/libraries/TokenHandler.php`. You can inspect this file for the static string "academy-lms-xxxxxxxx" used as the JWT secret. Additionally, you can attempt to forge JWT tokens using the known default secret and verify if they are accepted by the system. For example, using the Python `jwt` library to create a token signed with the default secret and testing if it grants access can confirm the vulnerability. Specific commands include: 1) Searching for the secret in the code: `grep -r "academy-lms-" lms/application/libraries/TokenHandler.php` 2) Using a Python script with the `jwt` library to forge a token and test authentication against the system's API endpoints. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include changing the JWT secret to a cryptographically secure random value (e.g., a 64-character hex string generated via `random_bytes(32)`), invalidating all existing tokens, and forcing all users to re-authenticate. It is also recommended to store the secret securely in environment variables or configuration files rather than hardcoding it, implement JWT secret rotation, consider using asymmetric signing algorithms like RS256, and enforce proper token expiration policies. [1]