GHSA-43h9-hc38-qph5

Suggest an improvement
Source
https://github.com/advisories/GHSA-43h9-hc38-qph5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-43h9-hc38-qph5/GHSA-43h9-hc38-qph5.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-43h9-hc38-qph5
Aliases
Published
2025-12-27T15:30:17Z
Modified
2026-01-01T00:48:50.762799Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
  • 2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key
Details

A security vulnerability has been detected in actiontech sqle up to 4.2511.0. The impacted element is an unknown function of the file sqle/utils/jwt.go of the component JWT Secret Handler. The manipulation of the argument JWTSecretKey leads to use of hard-coded cryptographic key.

The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report and is planning to fix this flaw in an upcoming release.

Database specific 
{
    "nvd_published_at": "2025-12-27T13:15:39Z",
    "cwe_ids": [
        "CWE-321",
        "CWE-798"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-29T20:36:20Z"
}
References

Affected packages

Go / github.com/actiontech/sqle

Package

Name
github.com/actiontech/sqle
View open source insights on deps.dev
Purl
pkg:golang/github.com/actiontech/sqle

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
4.2511.0