CVE-2026-46684: Weak Jwt Secret Derivation Md5
Deriving a JWT secret key using an MD5 hash restricts the key's entropy to at most 128 bits and can make tokens vulnerable to offline forgery attacks, especially if the hashed input (like a password) is predictable. Use a cryptographically secure random value generation (e.g., SecureRandom or UUIDs) for symmetric signature secrets.
Javagreprules fetch cve-2026-46684-weak-jwt-secret-derivation-md5 --engine opengrepDescription
Deriving a JWT secret key using an MD5 hash restricts the key's entropy to at most 128 bits and can make tokens vulnerable to offline forgery attacks, especially if the hashed input (like a password) is predictable. Use a cryptographically secure random value generation (e.g., SecureRandom or UUIDs) for symmetric signature secrets.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.