CVE-2025-8974 Details
Description
A vulnerability was determined in linlinjava litemall up to 1.8.0. Affected by this issue is some unknown functionality of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/util/JwtHelper.java of the component JSON Web Token Handler. The manipulation of the argument SECRET with the input X-Litemall-Token leads to hard-coded credentials. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
A vulnerability exists in Linlinjava Litemall versions through 1.8.0, where the JSON Web Token (JWT) secret is hardcoded in the source code. This vulnerability is located in the JwtHelper.java file within the litemall-wx-api component. The hardcoded secret creates a predictable key for signing JWTs, allowing attackers to forge valid tokens. Exploitation of this vulnerability could lead to privilege escalation and unauthorized access.
It is recommended to replace the hardcoded JWT secret with a dynamically generated, strong, and unpredictable key. This can be done by generating the secret at runtime or sourcing it from a secure configuration.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 14, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/linlinjava/litemall/issues/568 | [email protected] | ExploitIssue TrackingVendor Advisory |
| https://github.com/linlinjava/litemall/issues/568#issue-3289860066 | [email protected] | ExploitIssue TrackingVendor Advisory |
| https://vuldb.com/?ctiid.319970 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.319970 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.628233 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-259 | Use of Hard-coded Password | [email protected] |
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linlinjava litemall | <= 1.8.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Sep 11, 2025 | Initial Analysis | [email protected] |
| Aug 14, 2025 | New CVE Received | [email protected] |