External risk intelligence

Peppermint JWT Signing Secret Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-85391

The vulnerability exists in an API component that uses JWTs for authentication. Such services are commonly deployed as internet-facing web applications or API endpoints, making the authentication mechanism and its underlying secrets a typical part of the public-facing attack surface.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a vulnerability in Peppermint affecting its authentication system, specifically a hardcoded secret used for signing session tokens. This means attackers could potentially create fake login credentials to access user accounts and protected data without authorization. The main concern is confirming if this specific technology is in use and, if so, assessing the exposure of sensitive information.

Hardcoded secret allows fake logins.
Account access and data theft risk.
Confirm use and assess relevant exposure.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by leveraging a hardcoded secret found in the application's configuration to forge session tokens. This allows them to impersonate any user, bypassing authentication and gaining unauthorized access to protected areas of the application.

Entry condition: Publicly accessible application configuration.
Trigger point: Forging a session token using a hardcoded secret.
Resulting risk: Unauthenticated access to protected data.

Live Threat

Current exploitation, exposure, and threat context

A hardcoded JWT signing secret allows unauthenticated attackers to forge session tokens, potentially granting them access to protected system data and service endpoints. This exposure is possible when the affected application is deployed in a way that exposes the JWT signing mechanism.

System data and user sessions at risk.
Forged tokens bypass authentication.
Unauthorized access to protected features.

Operational Fix

Recommended remediation, mitigation, and detection steps

The presence of a hardcoded JWT signing secret in `docker-compose.yml` points to the application or platform team as the primary owner for remediation, as they manage the deployment and configuration of the Peppermint service. The initial step is to locate all instances of this service, assess their exposure and criticality, and then coordinate the update or rotation of the secret, potentially requiring vendor engagement.

Application or platform teams own the issue.
Verify JWT usage and service exposure.
Plan secret rotation and update deployment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Peppermint software?

Peppermint is a software platform used for building and managing web-based applications or API services. It leverages JSON Web Tokens (JWTs) to handle user sessions and secure protected communication channels within its environment, acting as a core component for authenticating users and controlling access to internal application data.

What does CWE-798 mean for CVE-2026-85391?

CWE-798 refers to the use of hardcoded credentials. In the context of CVE-2026-85391, it means the software contains a permanent, easily discoverable secret key used to digitally sign authentication tokens. Because this secret is embedded directly in the configuration file rather than generated uniquely, it allows anyone who knows the secret to create valid-looking identity tokens for any account.

How do attackers trigger this vulnerability?

An attacker triggers this by using the publicly known secret key to sign their own forged authentication tokens. By crafting these tokens to claim the identity of an arbitrary user, they can bypass the normal login process entirely. Simply accessing the application does not trigger the bug; the attacker must actively submit these forged tokens to the system's endpoints to gain unauthorized access.

Is my environment at risk from this CVE?

According to Halo Surface Signal, this vulnerability is most relevant if your Peppermint instance is deployed as an internet-facing application. Because the affected component handles authentication via tokens, services exposed to the public internet are highly likely to have their JWT signing mechanisms reachable, making the system susceptible to remote impersonation attacks.

How should I respond to CVE-2026-85391?

First, identify all deployed instances of Peppermint in your environment. Since the secret is located in the docker-compose.yml file, coordinate with your platform team to rotate this credential immediately to invalidate any previously forged tokens. Ensure that future deployments use securely managed, environment-specific secrets rather than hardcoded values to prevent further unauthorized access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.