CVE-2026-2215

A vulnerability was detected in rachelos WeRSS we-mp-rss up to 1.4.8. This issue affects some unknown processing of the file core/auth.py of the component JWT Handler. Performing a manipulation of the argument SECRET_KEY results in use of default cryptographic key. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit is now public and may be used.

Scoring

Severity

MEDIUM

CVSS base score

6.3

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

EPSS probability

0.28%

CWE

CWE-1394

Published

2026-02-09

Last modified

2026-03-12

Affected products

• rachelos WeRSS we-mp-rss
• rachelos WeRSS we-mp-rss
• rachelos WeRSS we-mp-rss
• rachelos WeRSS we-mp-rss
• rachelos WeRSS we-mp-rss
• rachelos WeRSS we-mp-rss
• rachelos WeRSS we-mp-rss
• rachelos WeRSS we-mp-rss

Weakness type

• CWE-1394

Related vulnerabilities

• CVE-2026-75870 — Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret
• CVE-2026-54887 — DTLS server cookie bypass during startup window due to empty initial cookie secret
• CVE-2026-5039 — Predictable Default Cryptographic Key Used for DES Encryption in TP-Link TL-WL841N
• CVE-2026-20709 — Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver...
• CVE-2026-25815 — Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device...
• CVE-2025-41742 — Sprecher Automation: SPRECON-E series has a critical vulnerability due to the use of static cryptographic keys in system components
• CVE-2025-41744 — Sprecher Automation: SPRECON-E series has static default key material for TLS connections
• CVE-2025-55049 — Use of Default Cryptographic Key (CWE-1394)

Markdown version · Browse all CVEs