Description
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.
Remediation
References
https://github.com/YMFE/yapi/issues/2117
https://securitylab.github.com/advisories/GHSL-2020-228-YMFE-yapi
Related Vulnerabilities
CVE-2020-6422 Vulnerability in npm package electron
CVE-2020-11009 Vulnerability in maven package org.rundeck:rundeck
CVE-2019-1003078 Vulnerability in maven package org.jenkins-ci.plugins:labmanager
CVE-2023-23630 Vulnerability in npm package eta
CVE-2021-21141 Vulnerability in maven package org.webjars.npm:electron