by Kastro
Paper/Archive/CVE-2026-85391

CVE-2026-85391

Peppermint-Lab peppermint — Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.7.507 × 2010.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.

Affected

ProductAffectedFixed inSource
peppermint≤ 0.5.5–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/Peppermint-Lab/peppermint/issues/528refgithub.com/Peppermint-Lab/peppermintwriteupgithub.com/Peppermint-Lab/peppermint/blob/0.5.5/docker-compose.ymlwriteupgithub.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/lib/jwt.tswriteupvulncheck.com/advisories/peppermint-through-0.5.5-use-of-hard-coded-jwt-signing-secret-in-docker-compose-yml