High severity · published Dec 8, 2025
CVE-2025-14261
Lack of entropy allows registered low-privileged users of Litmus to crack valid JWT tokens and gain admin privileges
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
The Litmus platform uses JWT for authentication and authorization, but the secret being used for signing the JWT is only 6 bytes long at its core, which makes it extremely easy to crack.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
litmus · Litmuschaos
before 3.23.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14261
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14261
github.com
https://github.com/litmuschaos/litmus/pull/5324
research.jfrog.com
https://research.jfrog.com/vulnerabilities/litmus-jwt-missing-entropy-elevation-jfsa-2025-001648159/
More from litmus
9.9
CVE-2025-8795
A vulnerability, which was classified as critical, was found in LitmusChaos Litmus up to 3.19.0
8.8
CVE-2025-8797
A vulnerability was found in LitmusChaos Litmus up to 3.19.0 and classified as critical
7.8
CVE-2025-8794
A vulnerability, which was classified as problematic, has been found in LitmusChaos Litmus up to 3.19.0
6.3
CVE-2025-8791
A vulnerability was found in LitmusChaos Litmus up to 3.19.0
5.4
CVE-2025-8796
A vulnerability has been found in LitmusChaos Litmus up to 3.19.0 and classified as problematic