egOS WebGUI Hard-Coded JWT Secret Key Vulnerability Allowing Authentication Bypass

A vulnerability exists in the egOS WebGUI backend where the JWT secret key is hard-coded and accessible to the default user. This allows an unauthenticated remote attacker to generate valid HS256 tokens, bypassing authentication and authorization mechanisms.

Impact

Exploitation of this vulnerability allows for authentication and authorization bypass, enabling unauthorized access to resources or functionalities that require user authentication.