CVE-2023-31579

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-02 · updated 2026-06-17
Weakness: CWE-798

Description

Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token.

Affected products

Tangyh Lamp-Cloud: before 3.8.1 — fixed in 3.8.1

How to fix

Upgrade to a fixed version: Tangyh Lamp-Cloud 3.8.1. Check the vendor advisory for mitigations.

References

https://github.com/dromara/lamp-cloud/issues/183
https://github.com/xubowenW/JWTissues/blob/main/lamp%20issue.md
https://github.com/dromara/lamp-cloud/issues/183
https://github.com/xubowenW/JWTissues/blob/main/lamp%20issue.md

Get alerted when CVE-2023-31579 or the next vulnerability affects your stack