Vantage6 Server JWT Secret Key Vulnerability

A vulnerability exists in the Vantage6 server's JSON Web Token (JWT) secret key generation. The default key is an auto-generated UUID1, which lacks cryptographic security and is somewhat predictable. This issue affects Vantage6 server versions prior to 4.11.0. Users can manually define a secure JWT secret key in the server configuration file.

Impact

The vulnerability allows for the generation of a predictable JWT secret key, which can compromise the integrity of JWT-based authentication by making it easier to forge tokens.

Remediation

Users can upgrade to Vantage6 server version 4.11.0 or later, or define a custom JWT secret key in the server configuration file.