CVE-2025-51606

hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical security risk in systems where authentication and authorization rely on the integrity of JWTs.

• CWE-798

• https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250610-01.md

Published

Aug 21, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-51586An issue was discoverd in file controllers/admin/AdminLoginC…3.7
• CVE-2025-5159A vulnerability was found in H3C SecCenter SMP-E1114P02 up t…7.5
• CVE-2025-51591A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 al…3.7
• CVE-2025-5160A vulnerability classified as problematic has been found in …7.5
• CVE-2025-51602mmstu.c in VideoLAN VLC media player before 3.0.22 allows an…4.8
• CVE-2025-51605An issue was discovered in Shopizer 3.2.7. The server's CORS…8.1
• CVE-2025-5161A vulnerability classified as problematic was found in H3C S…7.5
• CVE-2025-5162A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-51624Cross-site scripting (XSS) vulnerability in Zone Bitaqati th…7.6
• CVE-2025-51626SQL injection vulnerability in pss.sale.com 1.0 via the id p…6.5
• CVE-2025-51627Incorrect access control in CaricaVerbale in Agenzia Impresa…6.5
• CVE-2025-51628Insecure Direct Object Reference (IDOR) vulnerability in Pdf…7.5