macrozheng Mall-Tiny Insecure Permissions Vulnerability Allowing JWT Forgery and Authentication Bypass

A vulnerability exists in macrozheng mall-tiny version 1.0.1 due to insecure permissions related to JSON Web Token (JWT) handling. The application hardcodes JWT signing keys, which remain static, and embeds user information directly into the JWT. This information is subsequently used for privilege management. As a result, it is possible to forge JWTs for any user, bypassing authentication mechanisms.

Impact

Exploitation of this vulnerability allows for authentication bypass by forging JWTs, which can lead to unauthorized access and privilege escalation within the application.