What’s Vulnerable › Vulnerabilities

CVE-2026-85391: Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-03 · updated 2026-09-09
• Weakness: CWE-798

Description

Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.

Affected products

• Peppermint-Lab peppermint: through 0.5.5

References

• https://github.com/Peppermint-Lab/peppermint
• https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/lib/jwt.ts
• https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/docker-compose.yml
• https://github.com/Peppermint-Lab/peppermint/issues/528
• https://www.vulncheck.com/advisories/peppermint-through-0.5.5-use-of-hard-coded-jwt-signing-secret-in-docker-compose-yml

Get alerted when CVE-2026-85391 or the next vulnerability affects your stack