VulnerabilityDeferred

CVE-2025-51606

hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation.

HIGH 8.8EPSS 0.35%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.35%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical security risk in systems where authentication and authorization rely on the integrity of JWTs.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.35% probability · 29th percentile
CISA KEV: Not listed
Weakness: CWE-798
Source: cve@mitre.org

References

https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250610-01.md

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.