CVE-2025-43866 LOW

CVE-2025-43866: Vantage6 Server JWT secret not cryptographically secure

Vendor Vantage6
Product vantage6
Weakness CWE-330 · Insufficient randomness
Published June 12, 2025
Last update June 13, 2025
View on NVD All CVEs

CVSS base score

1.7/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U

What the vulnerability does

01Description

vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This vulnerability is fixed in 4.11.0.

Key dates

02Disclosure timeline

June 12, 2025 CVE published
June 13, 2025 Record updated