PT-2025-52522 · Unknown · Ever Gauzy 0.281.9

Nu11Secur1Ty · Published 2025-12-19 · Updated 2025-12-20 · CVE-2023-53951

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ever Gauzy version 0.281.9

Description The software contains a JWT authentication issue due to a weak HMAC secret key implementation. This allows attackers to exploit the exposed JWT token to authenticate and gain unauthorized access, potentially with administrative permissions. Attackers can forge JWT tokens to achieve instant admin access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2023-53951

Affected Products

Ever Gauzy 0.281.9

References · 11

• 🔥 https://exploit-db.com/exploits/51354 · Exploit
• https://osv.dev/vulnerability/CVE-2023-53951 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53951 · Security Note
• https://github.com/ever-co/ever-gauzy · Note
• https://twitter.com/CVEnew/status/2002466768103649554 · Twitter Post
• https://twitter.com/0dayPublishing/status/2002128203565998400 · Twitter Post
• https://t.me/CVEtracker/40314 · Telegram Post
• https://twitter.com/CveFindCom/status/2002131725044809949 · Twitter Post
• https://twitter.com/TheHackerWire/status/2002137740716978649 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2002153691415973953 · Twitter Post
• https://vulncheck.com/advisories/ever-gauzy-jwt-authentication-weakness-via-hmac-secret · Note