CVE-2026-46684: Weak Jwt Secret Derivation Md5cve-2026-46684-weak-jwt-secret-derivation-md5
Deriving a JWT secret key using an MD5 hash restricts the key's entropy to at most 128 bits and can make tokens vulnerable to offline forgery attacks, especially if the hashed input (like a password) is predictable. Use a cryptographically secure random value generation (e.g., SecureRandom or UUIDs) for symmetric signature secrets.
