PT-2025-21802 · Donetick · Donetick
S4Dmach1Ne
·
Published
2025-05-17
·
Updated
2025-05-17
·
CVE-2025-47945
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Donetick versions prior to 0.1.44
Description:
The issue concerns the use of JSON Web Tokens (JWT) for authentication in Donetick, an open-source task management application. Prior to version 0.1.44, the application uses a weak default signing secret, which can be exploited to gain full control of any user's account. This vulnerability is demonstrated by its existence in the live version of the application. The responsibility to change the signing secret is left to the system administrator, but this approach is considered inadequate.
Recommendations:
For versions prior to 0.1.44, update to version 0.1.44 or later to patch the vulnerability. As a temporary workaround, consider changing the default signing secret to a stronger value to minimize the risk of exploitation. Restrict access to sensitive features that rely on JWT authentication until the update is applied.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Donetick