PT-2025-24933 · Unknown · Archiverspaapi

Published 2025-06-10 · Updated 2025-06-10 · CVE-2025-35940

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ArchiverSpaApi (affected versions not specified)

Description The ArchiverSpaApi ASP.NET application uses a hard-coded JWT signing key. An unauthenticated remote attacker can generate and use a verifiable JWT token to access protected ArchiverSpaApi URL endpoints, such as "/api/v1/login" or "/users/{id}". The attacker can exploit this issue by using a forged JWT token with the username and password variables to gain unauthorized access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-35940

Affected Products

Archiverspaapi

References · 6

• 🔥 https://tenable.com/security/research/tra-2025-17 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-35940 · Security Note
• https://t.me/cvetracker/25962 · Telegram Post
• https://t.me/cvenotify/125345 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1932558934394482799 · Twitter Post
• https://twitter.com/CVEnew/status/1932562264889946313 · Twitter Post