Use Of Hard-coded Credentials

label_studio is vulnerable to Hard-coded Credentials. An attacker is able to forge session tokens using the hardcoded secret key, which could allow them to impersonate any user on a vulnerable Label Studio instance. The attacker could exploit this vulnerability by sending a specially crafted HTTP request which contains a forged session token that the attacker generated using the hardcoded secret key. The server would then accept the forged token and authenticate the attacker as the user specified in the token.