[Security Issue] lollms accepts administrator JWTs signed with its shipped weak key #20

Summary

When SECRET_KEY is unset, lollms uses the public default a_very_secret_key_that_should_be_changed_for_production to sign HS256 JWTs. An unauthenticated attacker can use that key to forge an administrator token.

Details

The forged token uses {"sub":"admin","exp":<future>} and is accepted by the administrator authorization dependency. No valid account credentials are required.

PoC

Run the real backend with its default configuration, then create an HS256 token with the shipped key and request:

GET /api/admin/users
Authorization: Bearer <forged-token>

Observed on the affected tag:

HTTP 200
BYPASS_SUCCESS: forged administrator JWT accepted

Impact

An unauthenticated remote attacker can access administrator-only API endpoints and perform actions available to the administrator.