CVE-2026-2215CWE-1394

rachelos WeRSS we-mp-rss JWT auth.py default key

Medium · published February 9, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
22.8
In the wild
Unconfirmed
What it is

A vulnerability was detected in rachelos WeRSS we-mp-rss up to 1.4.8. This issue affects some unknown processing of the file core/auth.py of the component JWT Handler. Performing a manipulation of the argument SECRET_KEY results in use of default cryptographic key. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit is now public and may be used.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00312 · 22.8th percentile
Weakness
CWE-1394 · Use of Default Cryptographic Key
Published
2026-02-09T04:32Z
EPSS history
Timeline
  • 09 FEB 04:32Z
    rachelos WeRSS we-mp-rss JWT auth.py default key
    cvelistv5