Baiyuetribe/kamiFaka

[Vulnerability] 存在可能导致越权风险的硬编码JWT Secret

Open

#167 opened on Jun 16, 2026

View on GitHub
 (0 comments) (0 reactions) (0 assignees)Python (575 forks)github user discovery
buggood first issuequestion

Repository metrics

Stars
 (2,303 stars)
PR merge metrics
 (PR metrics pending)

Description

描述： 本项目是一个开源项目，任何用户都能获取到该项目中的硬编码的JWT Secret。同时，使用JWT Secret默认值启动项目时并没有任何警告提示，所以大多数用户可能不会修改此JWT Secret默认值，这可能导致攻击者伪造任意用户的权限令牌，从而绕过认证与授权机制，访问受保护接口。

影响:

  • 攻击者可伪造任意用户的 JWT
  • 可冒充管理员或高权限账号访问敏感接口
  • 用户身份认证机制失效
  • 可能导致数据泄露、越权操作或账户接管

修复： 可以将JWT Secret放入系统环境变量中或者禁止使用默认值启动项目。

Contributor guide

Research direction
Move the hardcoded JWT secret from the code to an environment variable and add a startup warning if the default secret is used.
Tech stack
python
Domain
backendsecurity
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
PythonGit
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
80