CVE-2025-51606 hippo4j Includes Hard Coded Secret Key in JWT Creation
Attackers can forge valid JWTs using a hard-coded secret key to impersonate any user, including administrators, in applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-51606?
CVE-2025-51606 is a high-severity vulnerability in n/a, published on 21 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical security risk in systems where authentication and authorization rely on the integrity of JWTs.
Weakness: CWE-798
Which versions are affected by CVE-2025-51606?
2 open source packages ship an affected version, including cn.hippo4j:hippo4j-core.
| Package | Affected | Fixed in |
|---|---|---|
cn.hippo4j:hippo4j-core Maven | From 1.0.0 to 1.5.0 | None |
cn.hippo4j:hippo4j-core Maven | From 1.0.0 to 1.5.0 | None |
How do I fix CVE-2025-51606?
No fix has been published for CVE-2025-51606 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-51606 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-51606 exists.
Sources
Also known as GHSA-48cg-9c55-j2q7.