CVE-2026-85391 Details
Description
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.
A vulnerability exists in Peppermint versions through 0.5.5, where a hardcoded JSON Web Token (JWT) signing secret is included in the docker-compose.yml file. This secret allows unauthenticated attackers to forge session tokens for any user account, including admin. The vulnerability arises because the secret is publicly accessible in the repository, enabling token creation that bypasses authentication. Exploitation of this vulnerability allows access to protected endpoints without credentials.
Remove the hardcoded SECRET value from docker-compose.yml and require users to supply a strong random value, such as through an env-file or a secret manager. Additionally, update the application to validate that a session record exists in the database for all protected routes that require authentication.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Peppermint-Lab/peppermint | [email protected] | ProductVendor |
| https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/lib/jwt.ts | [email protected] | Source CodeVendor |
| https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/docker-compose.yml | [email protected] | Source CodeVendor |
| https://github.com/Peppermint-Lab/peppermint/issues/528 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/peppermint-through-0.5.5-use-of-hard-coded-jwt-signing-secret-in-docker-compose-yml | [email protected] | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Peppermint-Lab Peppermint | <= 0.5.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | CVE Modified | CISA-ADP |
| Sep 3, 2026 | New CVE Received | [email protected] |