Description
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.
Remediation
References
https://github.com/YMFE/yapi/issues/2117
https://securitylab.github.com/advisories/GHSL-2020-228-YMFE-yapi
Related Vulnerabilities
CVE-2023-39156 Vulnerability in maven package org.jenkins-ci.plugins:bazaar
CVE-2017-16026 Vulnerability in npm package request
CVE-2021-21391 Vulnerability in npm package @ckeditor/ckeditor5-image
CVE-2020-2293 Vulnerability in maven package org.jenkins-ci.plugins:persona
CVE-2021-43116 Vulnerability in maven package com.alibaba.nacos:nacos-client