Riskcovery

CVE-2025-6669

gooaclok819 sublinkX jwt.go hard-coded key

State
Published
Severity
6.3 Medium
Published
Jun 25, 2025
Updated
Jul 1, 2025
Reserved
Jun 25, 2025

Read the record on cve.org

Description

A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file middlewares/jwt.go. The manipulation with the input sublink leads to use of hard-coded cryptographic key . The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9 is able to address this issue. The patch is identified as 778d26aef723daa58df98c8060c43f5bf5d1b10b. It is recommended to upgrade the affected component.

Scores

CVSSScoreVectorSource
4.06.3 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:PVulDB
3.13.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:CVulDB
3.03.7 LowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:CVulDB
2.02.6 LowAV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:CVulDB

Weaknesses

  • CWE-321 Use of Hard-coded Cryptographic Key
  • CWE-320 Key Management Error

Affected Products

ProductVersions
sublinkXgooaclok819
  • 1.0Affected
  • 1.1Affected
  • 1.2Affected
  • 1.3Affected
  • 1.4Affected
  • 1.5Affected
  • 1.6Affected
  • 1.7Affected
  • 1.8Affected
  • 1.9Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.