CVE-2024-48952

6.4 mediumEPSS 0.3%

Medium (6.4) in logpoint soar. EPSS 0.3% chance of exploitation in the next 30 days.

An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authentication. This static key vulnerability enables attackers to create custom JWT secret keys for unauthorized access to these endpoints.

Severity

CVSS 3.1

6.4 medium

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2024-11-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

logpoint:soar

References

https://docs.logpoint.com/docs/whats-new-in-logpoint/en/latest/
https://servicedesk.logpoint.com/hc/en-us/articles/21968950913693-Static-JWT-Key-enables-unauthorized-API-access
https://servicedesk.logpoint.com/hc/en-us/sections/7201103730845-Product-Security

Check your stack JSON