CVE-2025-14261 Details
Description
The Litmus platform uses JWT for authentication and authorization, but the secret being used for signing the JWT is only 6 bytes long at its core, which makes it extremely easy to crack.
A vulnerability in the Litmus platform's JWT authentication mechanism allows low-privileged users to crack JWT tokens and gain admin rights. This issue arises because the secret used to sign the JWT is only 6 bytes long, making it容易破解. The vulnerability affects Litmus versions prior to 3.23.0.
Users can update to Litmus version 3.23.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 8, 2025CISA-ADP
Assessed Dec 8, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/litmuschaos/litmus/pull/5324 | [email protected] | Issue TrackingVendor |
| https://research.jfrog.com/vulnerabilities/litmus-jwt-missing-entropy-elevation-jfsa-2025-001648159/ | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-331 | Insufficient Entropy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Litmus | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 8, 2025 | New CVE Received | [email protected] |