CVE-2025-41702CRITICAL 9.8EPSS p38.3%

CVE-2025-41702CVE-2025-41702

Description

The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.49% probability of exploitation · percentile 38.3% · 2026-06-19T12:03:05Z
Published2025-08-26
Last modified2026-04-15

Underlying weaknesses· 1

CWE-321

References

  1. https://certvde.com/de/advisories/VDE-2025-076

1

TypeTargetConfidenceTier
WeaknessUse of Hard-coded Cryptographic Keycwe-3210%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-41672
CVE
CVE-2025-54807
CVE
CVE-2025-41684
CVE
CVE-2025-56577
CVE
CVE-2025-41652
CVE
CVE-2025-27845
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.