CVE-2025-14261
BaseFortify
Publication date: 2025-12-08
Last updated on: 2025-12-08
Assigner: JFrog
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| litmus | litmus_platform | 3.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-331 | The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists because the Litmus platform uses JSON Web Tokens (JWT) for authentication and authorization, but the secret key used to sign these tokens is only 6 bytes long. Such a short secret key is extremely easy to crack, allowing attackers to potentially forge or manipulate JWTs.
How can this vulnerability impact me? :
Because the secret used to sign JWTs is very short and easy to crack, attackers could forge authentication tokens, potentially gaining unauthorized access to the system. This could lead to data exposure or denial of service, as indicated by the CVSS score showing low confidentiality impact but high availability impact.