CVE-2026-1114

The application signs JWT tokens using an excessively weak secret key. An attacker can perform an offline brute-force attack on an intercepted token, recovering this key without interaction with the server. After recovering the key, it is possible to modify the JWT token payload (e.g., granting administrator privileges) and re-sign it with the recovered key. Such a crafted token is accepted by the application, enabling privilege escalation and access to protected endpoints.

An attacker can impersonate an administrator, escalate their privileges, and gain unauthorized access to all protected resources and application endpoints, resulting in a complete breach of confidentiality, integrity, and availability of the system.

Update the application to version 2.2.0, where the issue has been resolved. It is also recommended to invalidate all active JWT tokens issued by the vulnerable version of the application.

parisneo/lollms version 2.1.0