CVE-2025-15107

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-15107
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15107.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-15107
Aliases
Downstream
Related
Published
2025-12-27T12:32:06.081Z
Modified
2026-07-08T08:10:14.144444932Z
Severity
  • 2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
actiontech sqle JWT Secret jwt.go hard-coded key
Details

A security vulnerability has been detected in actiontech sqle up to 4.2511.0. The impacted element is an unknown function of the file sqle/utils/jwt.go of the component JWT Secret Handler. The manipulation of the argument JWTSecretKey leads to use of hard-coded cryptographic key . The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report and is planning to fix this flaw in an upcoming release.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15107.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-320",
        "CWE-321"
    ]
}
References

Affected packages

Git / github.com/actiontech/sqle

Affected ranges

Type
GIT
Repo
https://github.com/actiontech/sqle
Events
Introduced
e530a9d3fa7594aa614b4c24e3d6d9953e0fa230
Last affected
e530a9d3fa7594aa614b4c24e3d6d9953e0fa230
Database specific 
{
    "cpe": "cpe:2.3:a:actionsky:sqle:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.2511"
        },
        {
            "last_affected": "4.2511"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.2511.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

4.*
4.2511
v4.*
v4.2511.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15107.json"