mao888 bluebell-plus Hard-Coded JWT Secret Vulnerability in Authorization Bypass

A vulnerability exists in mao888 bluebell-plus versions through 2.3.0, where the JWT secret key is hard-coded in the source file bluebell_backend/pkg/jwt/jwt.go. This flaw allows attackers to forge valid JWT tokens, bypassing authentication and authorization mechanisms. The vulnerability can be exploited remotely, and while the exploitation is difficult, a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows for authentication bypass, enabling unauthorized users to forge JWT tokens and gain access to functionalities such as creating posts or comments.