CVE Catalog
CVE-2023-33371
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk0.85%
53th percentile - higher than 53% of all known CVEs
Summary
IDSecure version 4.7.26.0 and prior uses a hardcoded cryptographic key to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication.
Risk Assessment
Attackers can gain access to the system by bypassing authentication mechanisms, potentially leading to account takeover.
Recommendation
It is recommended to upgrade to the latest version of IDSecure that eliminates the use of the hardcoded cryptographic key.
Original NVD description (English source)
Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication.