Dashboard / CVE-2026-1114

CVE-2026-1114

CRITICAL
INFO Priority: 0.05 BB Relevance: 80/100
Published: 2026-04-07 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: High
A: High

Description

In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing JSON Web Tokens (JWT). This vulnerability allows an attacker to perform an offline brute-force attack to recover the secret key. Once the secret key is obtained, the attacker can forge administrative tokens by modifying the JWT payload and resigning it with the cracked secret. This enables unauthorized users to escalate privileges, impersonate the administrator, and gain access to restricted endpoints. The issue is resolved in version 2.2.0.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
lollms lollms 2.1.0

References & Advisories (2)

Bug Bounty Relevance

80 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

9.8 / 10.0 v3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.54%
Raw Score 0.005400
Percentile 45.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00540
2026-10-28
0.00540

Intelligence Sources

nvd ref →

External Links