CVE-2023-46943

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-13 · updated 2026-06-17
Weakness: CWE-798

Description

An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.

Affected products

evershopcommerce evershop: 1.0.0-beta, 1.0.0-beta1, 1.0.0-beta2, 1.0.0-beta3, 1.0.0-beta4, 1.0.0-beta5 (+6)

References

https://advisory.checkmarx.net/advisory/CVE-2023-46943/
https://devhub.checkmarx.com/cve-details/CVE-2023-46943/
https://advisory.checkmarx.net/advisory/CVE-2023-46943/
https://devhub.checkmarx.com/cve-details/CVE-2023-46943/

Get alerted when CVE-2023-46943 or the next vulnerability affects your stack