This vulnerability affects Datavane Datavines up to commit 13607645e14a4982468cfdbcf75c85cde63bae71 in the JWT Token Handler component. It involves the use of a hard-coded cryptographic key due to manipulation of the tokenSecret parameter in the TokenManager.java source file. The vulnerability can be exploited remotely but requires high complexity and is difficult to exploit. Although a patch commit (e540d6dc04e2e6ad11907fb655f3728a13e7b939) has been created, the vendor has not yet officially addressed or released a fix. The rolling release nature of the product complicates version tracking for affected or patched releases. The CVSS 4.0 base score is 6.3, reflecting medium severity with network attack vector, high attack complexity, and no privileges or user interaction required.

Successful exploitation could allow an attacker to bypass cryptographic protections by leveraging a hard-coded key, potentially undermining the security of JWT tokens handled by the application. This could lead to unauthorized access or token forgery. However, the difficulty of exploitation and lack of known active exploits reduce immediate risk. The vulnerability affects confidentiality and integrity aspects of the system's security.

A patch commit addressing this vulnerability exists but has not yet been officially released or integrated by the vendor. Users should monitor the official Datavane Datavines project for updates and apply the patch once it is made available. Until then, no official remediation or temporary workaround is documented. Patch status is not yet confirmed—check the vendor advisory or project repository for current remediation guidance.