Threats Tagged 'ghsa-jphh-m39h-6gwx'
View all threats tagged with 'ghsa-jphh-m39h-6gwx'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-jphh-m39h-6gwx'
Click on any threat for detailed analysis and mitigation recommendations
GHSA-jphh-m39h-6gwx: 9router's Hardcoded Default fallback JWT Secret Allows Authentication BypassCVE-2026-49352 0 9router versions from 0.2.21 up to but not including 0.4.45 use a publicly known hardcoded fallback JWT secret string "9router-default-secret-change-me" when the JWT_SECRET environment variable is not set. This allows unauthenticated remote attackers to forge valid authentication tokens and gain full access to the dashboard and API. The vulnerability has existed since the introduction of authentication in 9router and remains due to the fallback secret being unchanged and publicly committed. Successful exploitation grants attackers full API keys, authentication tokens, and the ability to modify or shut down the router. The recommended fix is to require the JWT_SECRET environment variable at startup and fail if it is not set, preventing fallback to the hardcoded secret. Join the discussion | GCVE Database | 07/02/2026, 20:56:55 UTC Added: 07/02/2026, 22:56:46 UTC |
Showing 1 to 1 of 1 result