CVE-2026-2215

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2215", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-08T08:30:03.928Z", "datePublished": "2026-02-09T04:32:06.678Z", "dateUpdated": "2026-02-23T09:56:44.351Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:56:44.351Z"}, "title": "rachelos WeRSS we-mp-rss JWT auth.py default key", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1394", "lang": "en", "description": "Use of Default Cryptographic Key"}]}], "affected": [{"vendor": "rachelos", "product": "WeRSS we-mp-rss", "versions": [{"version": "1.4.0", "status": "affected"}, {"version": "1.4.1", "status": "affected"}, {"version": "1.4.2", "status": "affected"}, {"version": "1.4.3", "status": "affected"}, {"version": "1.4.4", "status": "affected"}, {"version": "1.4.5", "status": "affected"}, {"version": "1.4.6", "status": "affected"}, {"version": "1.4.7", "status": "affected"}, {"version": "1.4.8", "status": "affected"}], "modules": ["JWT Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in rachelos WeRSS we-mp-rss up to 1.4.8. This issue affects some unknown processing of the file core/auth.py of the component JWT Handler. Performing a manipulation of the argument SECRET_KEY results in use of default cryptographic key. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit is now public and may be used."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-08T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-08T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-09T08:53:26.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "din4 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.344932", "name": "VDB-344932 | rachelos WeRSS we-mp-rss JWT auth.py default key", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.344932", "name": "VDB-344932 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.752756", "name": "Submit #752756 | rachelos WeRSS WeRSS<=1.4.8 Weak Authentication", "tags": ["third-party-advisory"]}, {"url": "https://www.notion.so/WeRSS-Weak-JWT-Key-Leading-to-Authentication-Bypass-2feea92a3c41803faadae58327facd7b", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T16:03:26.175618Z", "id": "CVE-2026-2215", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T16:03:43.026Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2215", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T16:03:26.175618Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T16:03:40.113Z"}}], "cna": {"title": "rachelos WeRSS we-mp-rss JWT auth.py default key", "credits": [{"lang": "en", "type": "reporter", "value": "din4 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "rachelos", "modules": ["JWT Handler"], "product": "WeRSS we-mp-rss", "versions": [{"status": "affected", "version": "1.4.0"}, {"status": "affected", "version": "1.4.1"}, {"status": "affected", "version": "1.4.2"}, {"status": "affected", "version": "1.4.3"}, {"status": "affected", "version": "1.4.4"}, {"status": "affected", "version": "1.4.5"}, {"status": "affected", "version": "1.4.6"}, {"status": "affected", "version": "1.4.7"}, {"status": "affected", "version": "1.4.8"}]}], "timeline": [{"lang": "en", "time": "2026-02-08T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-08T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-09T08:53:26.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.344932", "name": "VDB-344932 | rachelos WeRSS we-mp-rss JWT auth.py default key", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.344932", "name": "VDB-344932 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.752756", "name": "Submit #752756 | rachelos WeRSS WeRSS<=1.4.8 Weak Authentication", "tags": ["third-party-advisory"]}, {"url": "https://www.notion.so/WeRSS-Weak-JWT-Key-Leading-to-Authentication-Bypass-2feea92a3c41803faadae58327facd7b", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in rachelos WeRSS we-mp-rss up to 1.4.8. This issue affects some unknown processing of the file core/auth.py of the component JWT Handler. Performing a manipulation of the argument SECRET_KEY results in use of default cryptographic key. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit is now public and may be used."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1394", "description": "Use of Default Cryptographic Key"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:56:44.351Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2215", "state": "PUBLISHED", "dateUpdated": "2026-02-23T09:56:44.351Z", "dateReserved": "2026-02-08T08:30:03.928Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-09T04:32:06.678Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["JWT Handler"], "product": "WeRSS we-mp-rss", "vendor": "rachelos", "versions": [{"status": "affected", "version": "1.4.0"}, {"status": "affected", "version": "1.4.1"}, {"status": "affected", "version": "1.4.2"}, {"status": "affected", "version": "1.4.3"}, {"status": "affected", "version": "1.4.4"}, {"status": "affected", "version": "1.4.5"}, {"status": "affected", "version": "1.4.6"}, {"status": "affected", "version": "1.4.7"}, {"status": "affected", "version": "1.4.8"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in rachelos WeRSS we-mp-rss up to 1.4.8. This issue affects some unknown processing of the file core/auth.py of the component JWT Handler. Performing a manipulation of the argument SECRET_KEY results in use of default cryptographic key. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit is now public and may be used."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en rachelos WeRSS we-mp-rss hasta la versi\u00f3n 1.4.8. Este problema afecta a un procesamiento desconocido del archivo core/auth.py del componente JWT Handler. Realizar una manipulaci\u00f3n del argumento SECRET_KEY resulta en el uso de una clave criptogr\u00e1fica predeterminada. El ataque puede iniciarse de forma remota. El ataque se considera de alta complejidad. La explotabilidad se eval\u00faa como dif\u00edcil. El exploit ahora es p\u00fablico y puede ser utilizado."}], "id": "CVE-2026-2215", "lastModified": "2026-06-17T10:30:33.740", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2215", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-09T16:03:26.175618Z", "version": "2.0.3"}}]}, "published": "2026-02-09T05:16:25.100", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.344932"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.344932"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.752756"}, {"source": "cna@vuldb.com", "url": "https://www.notion.so/WeRSS-Weak-JWT-Key-Leading-to-Authentication-Bypass-2feea92a3c41803faadae58327facd7b"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1394"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T21:36:30.395693+00:00", "value": {"mitigation_remediation": ["Update WeRSS we-mp-rss to a version newer than 1.4.8 or apply the vendor's patch that eliminates the default key usage.", "Configure the application so that the SECRET_KEY setting is a unique, randomly generated value and not left at its default.", "Until the patch is applied, limit exposure of the JWT authentication endpoint by implementing network access controls or firewall rules that restrict remote connections to trusted hosts."], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "The issue affects the rachelos WeRSS we-mp-rss product for all releases up to and including version 1.4.8. No other versions or variants are known to be affected.", "description_and_impact": "A flaw in rachelos WeRSS we-mp-rss allows an attacker to manipulate the SECRET_KEY argument used by the JWT handler so that the default cryptographic key is employed. This requires a remote request that specifies the altered key value. The vulnerability was rated as having high complexity and difficult exploitability, but the exploit code is publicly available.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 6.3, indicating moderate severity, while the EPSS score is below 1%, reflecting a low probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. An attacker can remotely bypass authentication by exploiting the default key, potentially allowing unauthorized access to protected resources."}}}}, "created": "2026-02-09T10:39:19.170136+00:00", "updated": "2026-04-17T21:45:28.627832+00:00", "vendors": ["rachelos", "rachelos$PRODUCT$werss_we-mp-rss"]}