CVE-2025-7080

Done-0 Jank JWT Token jwt_utils.go hard-coded password

State: Published
Severity: 6.3 Medium
Published: Jul 6, 2025
Updated: Jul 7, 2025
Reserved: Jul 5, 2025

Description

A vulnerability, which was classified as problematic, was found in Done-0 Jank up to 322caebbad10568460364b9667aa62c3080bfc17. Affected is an unknown function of the file internal/utils/jwt_utils.go of the component JWT Token Handler. The manipulation of the argument accessSecret/refreshSecret with the input jank-blog-secret/jank-blog-refresh-secret leads to use of hard-coded password. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
3.0	3.7 Low	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
2.0	2.6 Low	AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-259 Use of Hard-coded Password
CWE-255 Credentials Management

Affected Products

Product	Versions
JankDone-0	322caebbad10568460364b9667aa62c3080bfc17Affected

References

VDB-314994 | Done-0 Jank JWT Token jwt_utils.go hard-coded passwordvdb-entrytechnical-description
VDB-314994 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #603746 | https://github.com/Done-0 https://github.com/Done-0/Jank 9b7b0cb Authorization Bypassthird-party-advisory
https://github.com/Done-0/Jank/issues/9exploitissue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.