CVE-2026-1114

In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing JSON Web Tokens (JWT). This vulnerability allows an attacker to perform an offline brute-force attack to recover the secret key. Once the secret key is obtained, the attacker can forge administrative tokens by modifying the JWT payload and resigning it with the cracked secret. This enables unauthorized users to escalate privileges, impersonate the administrator, and gain access to restricted endpoints. The issue is resolved in version 2.2.0.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/parisneo/lollms/commit/a3b2b82b84d537a9da63e63a370a6a8ad55fed34	Patch
https://huntr.com/bounties/608b2a3b-2225-438e-9e61-ffbfdec2ed89	Exploit Third Party Advisory
https://huntr.com/bounties/608b2a3b-2225-438e-9e61-ffbfdec2ed89	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lollms:lollms:2.1.0:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) En la versión 2.1.0 de parisneo/lollms, la gestión de sesiones de la aplicación es vulnerable a un control de acceso inadecuado debido al uso de una clave secreta débil para firmar JSON Web Tokens (JWT). Esta vulnerabilidad permite a un atacante realizar un ataque de fuerza bruta offline para recuperar la clave secreta. Una vez obtenida la clave secreta, el atacante puede falsificar tokens administrativos modificando la carga útil del JWT y volviéndolo a firmar con el secreto descifrado. Esto permite a usuarios no autorizados escalar privilegios, suplantar al administrador y obtener acceso a puntos finales restringidos. El problema se resuelve en la versión 2.2.0.

Information

Published : 2026-04-07 07:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-1114

Mitre link : CVE-2026-1114

CVE.ORG link : CVE-2026-1114

JSON object : View

Products Affected

lollms

lollms

CWE

CWE-284

Improper Access Control

NVD-CWE-Other

{"id": "CVE-2026-1114", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1114", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-07T13:20:34.622030Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@huntr.dev", "affectedData": [{"vendor": "parisneo", "product": "parisneo/lollms", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "2.2.0", "versionType": "custom"}]}]}], "published": "2026-04-07T07:16:23.633", "references": [{"url": "https://github.com/parisneo/lollms/commit/a3b2b82b84d537a9da63e63a370a6a8ad55fed34", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/608b2a3b-2225-438e-9e61-ffbfdec2ed89", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/608b2a3b-2225-438e-9e61-ffbfdec2ed89", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing JSON Web Tokens (JWT). This vulnerability allows an attacker to perform an offline brute-force attack to recover the secret key. Once the secret key is obtained, the attacker can forge administrative tokens by modifying the JWT payload and resigning it with the cracked secret. This enables unauthorized users to escalate privileges, impersonate the administrator, and gain access to restricted endpoints. The issue is resolved in version 2.2.0."}, {"lang": "es", "value": "En la versi\u00f3n 2.1.0 de parisneo/lollms, la gesti\u00f3n de sesiones de la aplicaci\u00f3n es vulnerable a un control de acceso inadecuado debido al uso de una clave secreta d\u00e9bil para firmar JSON Web Tokens (JWT). Esta vulnerabilidad permite a un atacante realizar un ataque de fuerza bruta offline para recuperar la clave secreta. Una vez obtenida la clave secreta, el atacante puede falsificar tokens administrativos modificando la carga \u00fatil del JWT y volvi\u00e9ndolo a firmar con el secreto descifrado. Esto permite a usuarios no autorizados escalar privilegios, suplantar al administrador y obtener acceso a puntos finales restringidos. El problema se resuelve en la versi\u00f3n 2.2.0."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lollms:lollms:2.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C17EE607-0C5D-4186-AFFB-93818FA92252"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}