CVE-2023-53951

critical · 9.3

Ever Gauzy v0.281.9 contains a JWT authentication vulnerability that allows attackers to exploit weak HMAC secret key implementation. Attackers can leverage the exposed JWT token to authenticate and gain unauthorized access with administrative permissions.

9.3

CVSS

0.4%

EPSS (exploit prob.)

30th

EPSS percentile

2025-12-19

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-347

References

https://github.com/ever-co/ever-gauzy
https://www.exploit-db.com/exploits/51354
https://www.vulncheck.com/advisories/ever-gauzy-jwt-authentication-weakness-via-hmac-secret

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-53951