CVE-2025-51606

Name: CVE-2025-51606
Creator: NVD / NIST
Published: 2025-08-21T21:15:35.65+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 0.33%

Last modified Jun 17, 2026

CVE-2025-51606 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". EPSS estimates a 0.33% chance of exploitation in the next 30 days.

Description

hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical security risk in systems where authentication and authorization rely on the integrity of JWTs.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.33%

24.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-798

References

https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250610-01.md

Timeline

Published: Aug 21, 2025
Last Modified: Jun 17, 2026
Status: Deferred

Frequently Asked Questions

What is CVE-2025-51606?

How severe is CVE-2025-51606?

CVE-2025-51606 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 0.33% probability of exploitation in the next 30 days.

How do I fix CVE-2025-51606?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-51606?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST