CVE-2026-0622: Insecure Jwt Secret Env Fallbackcve-2026-0622-insecure-jwt-secret-env-fallback
The application uses a statically hard-coded string as a fallback for a JWT or session secret when the environment variable is not configured. This allows an attacker to bypass authentication by signing a forged JSON Web Token (JWT) or session cookie using the known default secret. To fix, require the environment variable to be set, or dynamically generate a
