CVE-2026-85391
CriticalCVSS 9.8Summary
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.
Risk Assessment
An attacker could take over user accounts and gain full access to the application, potentially leading to data breach or unauthorized actions.
Recommendation
Change the JWT signing secret to a unique, random value and update Peppermint to a patched version.
Other vulnerabilities in Peppermint
See all- CVE-2026-85392Medium
Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling the logout handler with another user's ID, since the endpoint performs no authorization checks to verify the caller owns the target account.
- CVE-2026-72561High
A vulnerability in Peppermint Lab Peppermint (through commit ba6e217) allows any authenticated non-admin user to reconfigure global OIDC/SSO settings via an unprotected endpoint. No admin role check is performed.
- CVE-2026-72555High
A broken access control vulnerability in Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installations. All authenticated users bypass ownership and administrative access controls. An attacker with any user account can read, modify, or delete tickets, clients, and users belonging to any other account.
Original NVD description (English source)
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.