CVE-2026-42869 Details

A vulnerability exists in SOCFortress CoPilot versions prior to 0.1.57, where a hardcoded JWT signing secret is used as a fallback in the authentication module. This secret is publicly known and is also included in the example environment file. Deployments that do not explicitly set the JWT_SECRET variable, such as those using the default Docker Compose configuration, will sign authentication tokens with this compromised value. As a result, an unauthenticated attacker can create admin-scoped JWTs, gaining full control over the application and all managed security tools without any credentials.

Users should update to SOCFortress CoPilot version 0.1.57 or later, and ensure that the JWT_SECRET environment variable is set to a secure, unique value. After updating, the application can be restarted to load the new secret. For deployments using TOTP (two-factor authentication), it is important to set the TOTP_ENCRYPTION_KEY variable before rotating the JWT_SECRET to avoid losing access to enrolled TOTP secrets.