Q-Free MaxTime Hard-Coded Cryptographic Key Vulnerability Allowing Authentication Bypass

A vulnerability exists in Q-Free MaxTime versions through 2.11.0, where a hard-coded cryptographic key is used in JSON Web Token (JWT) signing. This flaw allows an unauthenticated remote attacker to bypass authentication by sending crafted HTTP requests.

Impact

Exploitation of this vulnerability allows for unauthorized access by bypassing authentication mechanisms.

Remediation

Until an official patch is released, it is recommended to restrict and monitor network access to the management web application on devices running Q-Free MaxTime versions through 2.11.0.