What is CVE-2025-51606?

CVE-2025-51606 is a high-severity vulnerability in N/a, classified under Use of Hard-coded Credentials. CVSS score: 8.8/10. Published 2025-08-21.

How severe is CVE-2025-51606?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2025-51606 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in N/a

CVE-2025-51606

hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical security risk in systems where authentication and authorization rely on the integrity of JWTs.

EPSS: 0.003 (27.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

N/a — versions n/a

Weakness classification (CWE)

CWE-798 — Use of Hard-coded Credentials

Public proof-of-concept exploits

References

cve@mitre.org

Frequently asked questions

What is CVE-2025-51606?: CVE-2025-51606 is a high-severity vulnerability in N/a, classified under Use of Hard-coded Credentials. CVSS score: 8.8/10. Published 2025-08-21.
How severe is CVE-2025-51606?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2025-51606 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.