CVE-2025-69971: Hardcoded Jwt Secretcve-2025-69971-hardcoded-jwt-secret
A hard-coded string literal is used as the secret/key parameter of jsonwebtoken `sign` or `verify`. Embedding the HMAC signing key in source code allows anyone with access to the repository or a shipped bundle to recover the key and forge tokens with arbitrary identity and group claims, leading to authentication bypass and privilege escalation (see CVE-2025-
