VULNERABILITY INTELLIGENCE

CVE-2024-57432

CVSS score7.5 HIGH
EPSS probability0.53%
CISA KEVNot currently listed
Published2025-01-31
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge the JWT of any user to achieve authentication bypass.

Weakness classification

  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-287

Primary references