PT-2026-30796 · Lollms · Lollms

Published 2026-01-07 · Updated 2026-04-28 · CVE-2026-1114

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions parisneo/lollms versions prior to 2.2.0

Description Session management is subject to improper access control because a weak secret key is used for signing JSON Web Tokens (JWT). This allows an attacker to conduct an offline brute-force attack to recover the secret key and subsequently forge administrative tokens by modifying the JWT payload. This process enables unauthorized users to escalate privileges, impersonate the administrator, and access restricted endpoints.

Recommendations Update to version 2.2.0.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2026-06488

CVE-2026-1114

PYSEC-2026-170

Affected Products

Lollms

References · 8

• 🔥 https://huntr.com/bounties/608b2a3b-2225-438e-9e61-ffbfdec2ed89 · Exploit
• https://github.com/parisneo/lollms/commit/a3b2b82b84d537a9da63e63a370a6a8ad55fed34 · Patch
• https://osv.dev/vulnerability/PYSEC-2026-170 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1114 · Security Note
• https://bdu.fstec.ru/vul/2026-06488 · Security Note
• https://twitter.com/infoflowcloud/status/2045974347089600655 · Twitter Post
• https://twitter.com/CVEnew/status/2045972467475529807 · Twitter Post
• https://t.me/cveNotify/161173 · Telegram Post