CVE-2026-85391CWE-798hardcoded-credentials

CVE-2026-85391

Critical · published September 3, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
50.1
In the wild
Unconfirmed
What it is

Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00641 · 50.1th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-09-03T23:17Z
References (5)
https://github.com/Peppermint-Lab/peppermint · [email protected]https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/lib/jwt.ts · [email protected]https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/docker-compose.yml · [email protected]https://github.com/Peppermint-Lab/peppermint/issues/528 · [email protected]https://www.vulncheck.com/advisories/peppermint-through-0.5.5-use-of-hard-coded-jwt-signing-secret-in-docker-compose-yml · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 18:54Z
    Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml
    cvelistv5