CVE-2026-85391

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-85391

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85391.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-85391

Published

2026-09-03T18:54:24Z

Modified

2026-09-11T03:30:16Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml

Details

Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-798"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85391.json"
}

References

Affected packages

Git / github.com/peppermint-lab/peppermint

Affected ranges

Type

GIT

Repo

https://github.com/peppermint-lab/peppermint

Events

Introduced

Fixed

71ae71ba78e1d605bc4b178342710cc7f1dc3714

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.5.5"
        },
        {
            "fixed": "0.5.5"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

0.*

0.1

0.1.5

0.1.6

0.1.7.5

0.1.7.7

0.1.7.8

0.1.8.5

0.1.9

0.2

0.2.1

0.2.2

0.2.3

0.3

0.3.2

0.3.3

0.3.4

0.3.5

0.4

0.4.2

0.4.6

0.4.7

0.4.8

0.5.1

0.5.2

0.5.3.1

0.5.3.2

0.5.4.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85391.json"