Note Mark versions before 0.19.4 accept any base64-decodable JWT_SECRET regardless of size or entropy, including extremely short secrets (as small as 1 byte). This insufficient enforcement of secret strength (CWE-326) leads to inadequate encryption strength, potentially allowing attackers to compromise JWT tokens and bypass authentication or authorization controls (CWE-345). The vulnerability is addressed in version 0.19.4, which enforces minimum secret length and entropy requirements.

The vulnerability allows attackers to exploit weak JWT secrets, potentially enabling them to forge or manipulate JWT tokens. This can lead to a complete compromise of confidentiality and integrity of authentication tokens, allowing unauthorized access or privilege escalation. The CVSS score of 10 reflects the critical nature of this impact. No denial of service impact is indicated.

Upgrade Note Mark to version 0.19.4 or later, where the JWT_SECRET configuration enforces minimum length and entropy requirements, effectively mitigating this vulnerability. Since no official patch link or advisory is provided, users should verify the version upgrade from the official project repository or release notes. No additional mitigation is indicated.