Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| top.tangyh.basic:lamp-core(Maven) | 0 | 3.8.1 | N/A |
| top.tangyh.basic:lamp-util(Maven) | 0 | 3.8.1 | N/A |
CVSS Metrics
