Hardcoded credentials

2024-01-1302:15:00

PRIOn knowledge base

www.prio-n.com

npm

package vulnerability

hmac secret

json web tokens

security risk

6.8 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

39.3%

JSON

An issue was discovered in NPM’s package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as “secret”. A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.

CPENameOperatorVersion
evershopeq1.0.0 beta2
evershopeq1.0.0 beta1
evershopeq1.0.0 beta
evershopeq1.0.0 rc3
evershopeq1.0.0 rc1
evershopeq1.0.0 rc2
evershopeq1.0.0 beta3
evershopeq1.0.0 beta4
evershopeq1.0.0 beta5
evershopeq1.0.0 rc5

Name	Operator	Version
evershop	eq	1.0.0 beta2
evershop	eq	1.0.0 beta1
evershop	eq	1.0.0 beta
evershop	eq	1.0.0 rc3
evershop	eq	1.0.0 rc1
evershop	eq	1.0.0 rc2
evershop	eq	1.0.0 beta3
evershop	eq	1.0.0 beta4
evershop	eq	1.0.0 beta5
evershop	eq	1.0.0 rc5