CVE-2025-47945

Name: CVE-2025-47945
Creator: NVD / NIST
Published: 2025-05-17T19:15:46.523+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 0.57%

Last modified Jun 17, 2026

CVE-2025-47945 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens (JWT) for authentication, but the signing secret has a weak default value. EPSS estimates a 0.57% chance of exploitation in the next 30 days.

Description

Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens (JWT) for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to change it, this approach is inadequate. The vulnerability is proven by existence of the issue in the live version as well. This issue can result in full account takeover of any user. Version 0.1.44 contains a patch.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.57%

43.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Donetick	Donetick	< 0.1.44

References

https://github.com/donetick/donetick/commit/620b897bc0135f6668bb8a5562678104531108ebPatch
https://github.com/donetick/donetick/commit/b9a6e177eefdc605dedbc5320f0d93d6573d1db6Patch
https://github.com/donetick/donetick/security/advisories/GHSA-hjjg-vw4j-986xExploit, Vendor Advisory
https://github.com/donetick/donetick/security/advisories/GHSA-hjjg-vw4j-986xExploit, Vendor Advisory

Timeline

Published: May 17, 2025
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2025-47945?

How severe is CVE-2025-47945?

CVE-2025-47945 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 0.57% probability of exploitation in the next 30 days.

How do I fix CVE-2025-47945?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-47945?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST