CVE-2023-46943 EverShop at risk to unauthorized access via weak HMAC secret
Attackers can forge valid JWTs using a hardcoded HMAC secret to access sensitive information and perform unauthorized actions in Evershop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-46943?
CVE-2023-46943 is a critical vulnerability in n/a, published on 13 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.
Weakness: CWE-798
Which versions are affected by CVE-2023-46943?
2 open source packages ship an affected version, including @evershop/evershop. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@evershop/evershop npm | All versions | 1.0.0-rc.9 |
@evershop/evershop npm | All versions | 1.0.0-rc.9 |
Products include Evershop Evershop.
How do I fix CVE-2023-46943?
Upgrade @evershop/evershop to 1.0.0-rc.9 or later.
Is CVE-2023-46943 being exploited?
There is no known exploitation of CVE-2023-46943 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-28213 EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response
- CVE-2023-46498 Code execution in evershop
- CVE-2026-25993 EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys
- CVE-2023-46496 Directory Traversal in evershop
- CVE-2025-67419 evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API
Sources
Also known as GHSA-32r3-57hp-cgfw.