Litmus JWT Authentication Entropy Vulnerability Allowing Privilege Escalation

A vulnerability in the Litmus platform's JWT authentication mechanism allows low-privileged users to crack JWT tokens and gain admin rights. This issue arises because the secret used to sign the JWT is only 6 bytes long, making it容易破解. The vulnerability affects Litmus versions prior to 3.23.0.

Impact

Exploitation of this vulnerability allows low-privileged users to elevate their privileges to admin rights on the Litmus platform.

Remediation

Users can update to Litmus version 3.23.0 or later, where this vulnerability has been addressed.