CVE-2023-36647

7.5 highEPSS 0.8%

High (7.5) in prolion cryptospike. EPSS 0.8% chance of exploitation in the next 30 days.

A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via crafted JWT tokens.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-798
Published: 2023-12-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

prolion:cryptospike

References

https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36647
https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36647

Check your stack JSON