Threats tagged 'ghsa-4v4h-58rp-w43w'

ZKEACMS versions up to and including 4.4 contain an authentication bypass vulnerability due to a hard-coded cryptographic key used for signing JWT bearer tokens. This flaw allows unauthenticated attackers to forge tokens with administrative privileges, enabling unauthorized modification of articles and products and access to form submissions.