Ever Gauzy JWT Authentication Vulnerability Due to Weak HMAC Secret

A vulnerability in Ever Gauzy version 0.281.9 allows for exploitation of JWT authentication by taking advantage of a weak HMAC secret key implementation. This vulnerability enables attackers to intercept JWT tokens, which can then be used to authenticate and gain unauthorized administrative access. The issue arises from the application using a predictable HMAC secret key for signing JWTs, which can be exploited to forge tokens and impersonate users with elevated privileges.

Impact

Exploitation of this vulnerability allows for unauthorized authentication and access to administrative privileges within the application.

Reproduction

To reproduce this vulnerability, log into the application and send a request to the authentication endpoint. The response will include a JWT token in the 'Authorization' header. This token can be intercepted and used to authenticate as an admin user.