CVE-2024-46508

High

Published: 08/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In versions of yeti-platform before 2.1.12, attackers can generate valid JWT tokens if the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other than SECRET).

Risk Assessment

The organization may be exposed to unauthorized access to resources if an attacker exploits this vulnerability to generate valid JWT tokens.

Recommendation

It is recommended to change the value of YETI_AUTH_SECRET_KEY to a strong, unique secret to secure the system against unauthorized access.

Other vulnerabilities in yeti-platform

CVE-2024-46507High
A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform before version 2.1.12 allows attackers to execute code on the application server.

Original NVD description (English source)

yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other than SECRET).