SOCFortress CoPilot before version 0.1.57 contains a hardcoded JWT signing secret in backend/app/auth/utils.py and .env.example. If the JWT_SECRET environment variable is not explicitly set, the application uses this fallback secret to sign authentication tokens. Because this secret is publicly known, attackers can create arbitrary admin-scoped JWTs without credentials, allowing full compromise of the application and its managed security tools. This represents an improper authentication vulnerability (CWE-287) combined with use of a hardcoded secret (CWE-798) and insecure fallback configuration (CWE-522). The issue is resolved in version 0.1.57.

Exploitation allows unauthenticated attackers to forge admin-level JWT tokens, resulting in complete takeover of the SOCFortress CoPilot application and all security tools it manages. This leads to full confidentiality, integrity, and availability compromise of the affected system. The CVSS 3.1 base score is 10.0 (critical), reflecting network attack vector, no required privileges or user interaction, and complete system compromise.

A fix is available in SOCFortress CoPilot version 0.1.57. Users should upgrade to this version or later to eliminate the hardcoded JWT secret fallback. Until upgraded, ensure the JWT_SECRET environment variable is explicitly set to a strong, unique value to prevent use of the default hardcoded secret. No other mitigations are documented.