GHSA-m3mq-f375-5vgh
GitHub Security Advisory
Vantage6 Server JWT secret not cryptographically secure
✓ GitHub Reviewed
LOW
Has CVE
Advisory Details
### Impact
The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is [predictable to some extent](https://docs.python.org/3/library/uuid.html#uuid.uuid1)
### Patches
No
### Workarounds
You may define JWT secret key in the server configuration file
Affected Packages
PyPI
vantage6-server
Affected versions:
0
(fixed in 4.11.0)
Related CVEs
Key Information
2.5
/10
Dataset
Last updated: June 15, 2025 6:24 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.