CVE-2025-14261 — Lack of entropy allows registered low-privileged users of Litmus to crack valid JWT tokens and gain admin privileges

CVE-2025-14261

Lack of entropy allows registered low-privileged users of Litmus to crack valid JWT tokens and gain admin privileges PUBLISHED

Description (CNA)

The Litmus platform uses JWT for authentication and authorization, but the secret being used for signing the JWT is only 6 bytes long at its core, which makes it extremely easy to crack.

Affected (CNA)

Vendor / product	Versions
Litmuschaos / litmus	affected 0 before 3.23.0

CWE

CWE-331

References

https://research.jfrog.com/vulnerabilities/litmus-jwt-missing-entropy-elevation-jfsa-2025-001648159/
https://github.com/litmuschaos/litmus/pull/5324

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.