The yeti-platform before version 2.1.12 contains a vulnerability (CWE-798) where the default authentication secret key (SECRET) is used for JWT token generation. If this secret is not changed by setting the environment variable YETI_AUTH_SECRET_KEY to a unique value, attackers can generate valid JWT tokens and potentially gain unauthorized access. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. No official patch or remediation level is indicated in the available data.

Attackers can generate valid JWT tokens without authorization if the default secret key is unchanged, potentially allowing unauthorized access to the system. The confidentiality of the system is at high risk, but integrity and availability impacts are not indicated. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, users should immediately change the default JWT secret by setting YETI_AUTH_SECRET_KEY to a strong, unique value other than the default SECRET to prevent unauthorized token generation.