CVE-2026-85391
critical · 9.3Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.
9.3
CVSS
0.6%
EPSS (exploit prob.)
50th
EPSS percentile
2026-09-03
Published
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-798
References
- https://github.com/Peppermint-Lab/peppermint
- https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/lib/jwt.ts
- https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/docker-compose.yml
- https://github.com/Peppermint-Lab/peppermint/issues/528
- https://www.vulncheck.com/advisories/peppermint-through-0.5.5-use-of-hard-coded-jwt-signing-secret-in-docker-compose-yml
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2026-85391