AIKIDO-2025-10476

TL;DR

Affected versions of this package are vulnerable to JWT secret brute-force attacks due to insufficient secret length validation, allowing attackers to exploit weak secrets through offline brute-force techniques. Attackers can use tools to rapidly test millions of potential secrets against captured JWTs; successful guesses enable token forgery and authentication bypass. It compromises all JWT-protected endpoints, permitting unauthorized data access, account takeovers, or administrative privilege escalation. The risk intensifies if default/guessable secrets (e.g., secret123) remain undetected during deployment.