CVE-2026-1114: JWT Access Control in lollms

The core of the vulnerability lies in the weak secret key used to sign JWTs. An attacker can perform an offline brute-force attack to recover this key. Once the secret is compromised, they can forge administrative tokens by manipulating the JWT payload and resigning it with the cracked secret. This effectively grants the attacker the ability to impersonate an administrator, bypassing authentication and authorization mechanisms. The potential impact includes unauthorized access to sensitive data, modification of system configurations, and complete control over the lollms application. This vulnerability shares similarities with other JWT-related vulnerabilities where weak key management leads to privilege escalation.

1. Reserved2026-01-17
2. Published2026-04-07
3. EPSS updated2026-04-14

The primary mitigation for CVE-2026-1114 is to immediately upgrade lollms to version 2.2.0 or later, which addresses the weak secret key issue. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to sensitive endpoints and closely monitoring JWT activity for suspicious patterns. Implement a Web Application Firewall (WAF) with rules to detect and block JWT manipulation attempts. Regularly rotate the JWT secret key, even after upgrading, to minimize the impact of a potential compromise.