PT-2025-34299 · Hippo4J · Hippo4J

Published 2025-08-21 · Updated 2025-08-22 · CVE-2025-51606

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: hippo4j versions 1.0.0 through 1.5.0

Description: hippo4j uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as admin. The issue poses a critical security risk in systems where authentication and authorization rely on the integrity of JWTs.

Recommendations: versions prior to 1.6.0 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-51606

GHSA-48CG-9C55-J2Q7

Affected Products

Hippo4J

References · 8

• 🔥 https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250610-01.md · Exploit
• https://osv.dev/vulnerability/GHSA-48cg-9c55-j2q7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-51606 · Security Note
• https://github.com/opengoofy/hippo4j · Note
• https://github.com/opengoofy/hippo4j/blob/7d78be3cab526501ad876495862f4cec108da2af/threadpool/server/auth/src/main/java/cn/hippo4j/auth/security/JwtTokenManager.java#L51 · Note
• https://twitter.com/CVEnew/status/1958659357601931296 · Twitter Post
• https://t.me/CVEtracker/30645 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1958688636653773281 · Twitter Post