CVE-2026-85391

Peppermint, an open-source self-hosted ticketing application, ships with a hardcoded JSON Web Token (JWT) signing secret in its docker-compose.yml file in all versions through 0.5.5 (CWE-798: use of hardcoded credentials). An unauthenticated attacker with network access to an affected deployment can use this published secret to mint validly signed JWTs for arbitrary user IDs. With a forged token, the attacker can authenticate as any account, including privileged ones, and access protected endpoints without credentials. Any instance launched with the stock docker-compose.yml and no custom JWT secret override is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, and EPSS (0.3%, 28th percentile) indicates low near-term exploitation probability.

What to do: Upgrade Peppermint to a release newer than 0.5.5 when available and follow the vendor advisory; if you cannot upgrade immediately, override the hardcoded JWT signing secret in docker-compose.yml with a strong, unique value and restart the deployment to invalidate previously issued tokens. Check whether your instance uses the default secret, and restrict network exposure of the application (e.g., VPN or reverse-proxy authentication) until patched.