CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.0 are vulnerable due to hardcoded default JWT signing secrets in the config.py file, allowing attackers with source code access to forge valid JWT tokens. This exploitation can lead to unauthorized access to keyserver and telemetry APIs, posing a significant risk to applications relying on these components. Organizations using affected OpenSSL versions should prioritize immediate updates to mitigate potential security breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access to keyserver and telemetry APIs.
Related CVEs
Other vulnerabilities affecting the same vendor(s)