{"id":"CVE-2025-41702","aliases":["EUVD-2025-25832","GHSA-6498-6rj5-p7pf"],"status":"published","title":"egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass","description":"The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00522,"percentile":0.44574,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-321"],"published":"2025-08-26T06:10:57Z","modified":"2026-06-17T09:23:00Z","products":[{"vendor":"welotec","product":"eg400mk2-d11001-000101"},{"vendor":"welotec","product":"eg400mk2-d11101-000101"},{"vendor":"welotec","product":"eg500mk2-a11001-000101"},{"vendor":"welotec","product":"eg500mk2-a11001-000201"},{"vendor":"welotec","product":"eg500mk2-a11101-000101"},{"vendor":"welotec","product":"eg500mk2-a12011-000101"},{"vendor":"welotec","product":"eg500mk2-a21101-000101"},{"vendor":"welotec","product":"eg500mk2-b11001-000101"},{"vendor":"welotec","product":"eg500mk2-b11101-000101"},{"vendor":"welotec","product":"eg500mk2-c11001-000101"},{"vendor":"welotec","product":"eg500mk2-c11101-000101"},{"vendor":"welotec","product":"eg503l"},{"vendor":"welotec","product":"eg503l-g"},{"vendor":"welotec","product":"eg503l_4gb"},{"vendor":"welotec","product":"eg503w"},{"vendor":"welotec","product":"eg503w_4gb"},{"vendor":"welotec","product":"eg602l"},{"vendor":"welotec","product":"eg602w"},{"vendor":"welotec","product":"eg603l mk2"},{"vendor":"welotec","product":"eg603w mk2"},{"vendor":"welotec","product":"eg802w"},{"vendor":"welotec","product":"eg802w_i7_512gb_dinrail"},{"vendor":"welotec","product":"eg802w_i7_512gb_w/o dinrail"},{"vendor":"welotec","product":"eg804w"},{"vendor":"welotec","product":"eg804w pro"}],"references":[{"url":"https://certvde.com/de/advisories/VDE-2025-076"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-41702"},{"url":"https://github.com/advisories/GHSA-6498-6rj5-p7pf"}],"sources":{"cve":[{"id":"CVE-2025-41702","title":"egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass","description":"The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.","status":"published","published":"2025-08-26T06:10:57.464Z","modified":"2025-08-26T19:39:00.393Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-321"],"updated_at":"2026-11-02T14:32:31.631102Z"}],"euvd":[{"id":"EUVD-2025-25832","description":"The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.","status":"published","published":"2025-08-26T06:10:57Z","modified":"2025-08-26T19:39:00Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:31:52.651465Z"}],"ghsa":[{"id":"GHSA-6498-6rj5-p7pf","title":"The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An...","description":"The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.","status":"published","published":"2025-08-26T06:31:01Z","modified":"2025-08-26T06:31:01Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-321"],"updated_at":"2026-11-02T15:03:24.313553Z"}],"nvd":[{"id":"CVE-2025-41702","description":"The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key.","status":"published","published":"2025-08-26T06:15:32.923Z","modified":"2026-06-17T09:23:00.16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-321"],"updated_at":"2026-11-02T14:11:25.826804Z"}]}}