Vulnerability · Published Sep 18, 2025 · Assigned by VulDB
CVE-2025-10671youth-is-as-pale-as-poetry e-learning JWT Token JwtUtils.java encryptSecret random values
Low 3.7
In plain English
A low-severity weak randomness in e-learning from youth-is-as-pale-as-poetry. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Official description
A vulnerability has been found in youth-is-as-pale-as-poetry e-learning 1.0. Impacted is the function encryptSecret of the file e-learning-master\exam-api\src\main\java\com\yf\exam\ability\shiro\jwt\JwtUtils.java of the component JWT Token Handler. The manipulation leads to insufficiently random values. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| youth-is-as-pale-as-poetry | e-learning | 1.0 |
Weakness: CWE-330, CWE-310 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
References
- VDB-324792 | youth-is-as-pale-as-poetry e-learning JWT Token JwtUtils.java encryptSecret random values vdb-entry, technical-description
- VDB-324792 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #653029 | https://gitee.com/youth-is-as-pale-as-poetry/e-learning ExamSystem V1.0 Authentication Bypass Issues third-party-advisory
- https://github.com/SuJing-cy/CVE/blob/main/yfhl.md exploit