Description

Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-03T19:17:30.830Z",
  "pubdate": "2026-09-03T19:17:30.830Z",
  "executiveSummary": "Peppermint versions through 0.5.5 contain a critical security vulnerability involving a hardcoded JSON Web Token (JWT) signing secret located within the docker-compose.yml configuration file.\nThis flaw allows unauthorized, unauthenticated actors to bypass standard authentication mechanisms by manually crafting and signing session tokens.\nBy utilizing the exposed static secret, an attacker can impersonate any user within the system, including administrative accounts, leading to a complete compromise of confidentiality and integrity.\nThe vulnerability represents a severe risk as it requires no prior credentials or elevated privileges to execute; an attacker simply needs access to the source code or the repository where the configuration is exposed.\nThe ability to forge valid tokens enables unrestricted access to protected API endpoints, effectively granting full application control without passing through the intended authentication middleware.",
  "technicalDetails": "The root cause of this vulnerability is the inclusion of a static, hardcoded cryptographic key used to sign JWTs within the docker-compose.yml deployment manifest of Peppermint versions 0.5.5 and earlier.\nJWTs rely on a secret key to ensure the integrity and authenticity of the token claims; if the secret is known, the cryptographic signature can be replicated by external parties.\nThe attack flow begins with the discovery of the hardcoded secret string within the repository. Once obtained, the attacker can leverage standard JWT libraries or command-line tools to generate a new, maliciously crafted token.\nThe attacker defines the 'sub' (subject) or 'uid' (user identifier) field in the token payload to correspond to the target user account, including high-privilege administrative IDs.\nAfter configuring the payload, the attacker signs the token using the identified hardcoded secret and the appropriate algorithm specified by the application, typically HMAC-SHA (HS256).\nBecause the server uses the same hardcoded secret to verify incoming requests, the forged token is validated as legitimate by the application's authentication middleware.\nThe attacker then attaches this forged token to the 'Authorization: Bearer <token>' header of subsequent HTTP requests directed at protected endpoints.\nUpon receipt, the application confirms the signature is cryptographically valid and grants the attacker an active session context corresponding to the specified user identifier.\nThis bypasses all upstream authentication logic, effectively rendering the application's login and session management controls useless.\nThe scope of impact is total; post-exploitation, the attacker operates with the full permissions of the chosen identity, facilitating data exfiltration, modification of sensitive settings, and unauthorized execution of business logic."
}