Vulnerability · Published May 17, 2025 · Assigned by GitHub_M

CVE-2025-47945Donetick Has Weak Default JWT Secret

Critical 9.1

In plain English

A critical-severity security flaw in donetick from donetick. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.7%top 47.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens (JWT) for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to change it, this approach is inadequate. The vulnerability is proven by existence of the issue in the live version as well. This issue can result in full account takeover of any user. Version 0.1.44 contains a patch.

Affected products (as reported)

Vendor	Product	Versions
donetick	donetick	< 0.1.44

Weakness: CWE-453, CWE-1188 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/donetick/donetick/security/advisories/GHSA-hjjg-vw4j-986x x_refsource_CONFIRM
https://github.com/donetick/donetick/commit/620b897bc0135f6668bb8a5562678104531108eb x_refsource_MISC
https://github.com/donetick/donetick/commit/b9a6e177eefdc605dedbc5320f0d93d6573d1db6 x_refsource_MISC