rachelos WeRSS we-mp-rss JWT Handler Weak Secret Key Vulnerability Leading to Authentication Bypass

A vulnerability exists in rachelos WeRSS we-mp-rss versions through 1.4.8, specifically within the JWT Handler component in the core/auth.py file. The issue arises from the use of hardcoded, weak default secret keys for JWT authentication. Attackers can manipulate the SECRET_KEY argument to revert to the default cryptographic key, which is predictable and corresponds to the project name. This vulnerability allows for the creation of valid administrator tokens, effectively bypassing authentication. The vulnerability can be exploited remotely, and while the complexity of the attack is high, a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows for authentication bypass by forging valid JWT tokens, thereby gaining unauthorized access as an administrator.