Done-0 Jank Hard-Coded JWT Secret Vulnerability in Token Handler

A vulnerability exists in Done-0 Jank versions up to 322caebbad10568460364b9667aa62c3080bfc17, specifically within the JWT Token Handler component. The issue arises from hard-coded secret keys for access and refresh tokens in the file internal/utils/jwt_utils.go. This vulnerability allows remote attackers to forge valid JWT tokens, bypass authentication, and potentially manipulate content by creating posts or comments. The exploitation of this vulnerability is considered difficult due to the high complexity of the attack.

Impact

Exploitation of this vulnerability allows for authentication bypass by forging valid JWT tokens, which can be used to create posts or comments on behalf of the authenticated user.