Skip to content
Threat Feed
Subscribe

Product

Vlife (<= 2.0.1)

1 brief RSS
critical advisory

Authentication Bypass in vlife via Hardcoded JWT Signing Key

The vlife application through version 2.0.1 contains a hardcoded HS256 JWT signing key in TokenUtil, allowing unauthenticated attackers to forge tokens and gain administrative privileges.

vlife
2t 1c