CVE-2026-2215
rachelos WeRSS we-mp-rss JWT auth.py default key
- State
- Published
- Severity
- 6.3 Medium
- Published
- Feb 9, 2026
- Updated
- Feb 23, 2026
- Reserved
- Feb 8, 2026
Description
A vulnerability was detected in rachelos WeRSS we-mp-rss up to 1.4.8. This issue affects some unknown processing of the file core/auth.py of the component JWT Handler. Performing a manipulation of the argument SECRET_KEY results in use of default cryptographic key. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit is now public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 3.7 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 3.7 Low | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 2.6 Low | AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-1394 Use of Default Cryptographic Key
Affected Products
| Product | Versions |
|---|---|
WeRSS we-mp-rssrachelos |
|
References
- VDB-344932 | rachelos WeRSS we-mp-rss JWT auth.py default keyvdb-entrytechnical-description
- VDB-344932 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #752756 | rachelos WeRSS WeRSS<=1.4.8 Weak Authenticationthird-party-advisory
- https://www.notion.so/WeRSS-Weak-JWT-Key-Leading-to-Authentication-Bypass-2feea92a3c41803faadae58327facd7bexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.