---
id: CVE-2026-85391
title: >-
  Peppermint through 0.5.5 contains a hardcoded JWT signing secret in
  docker-compose.yml that allows unauthenticated attackers to forge session
  tokens for any account
summary: >-
  Peppermint through 0.5.5 contains a hardcoded JWT signing secret in
  docker-compose.yml that allows unauthenticated attackers to forge session
  tokens for any account. Attackers can use the published secret to mint valid
  tokens for arbitra…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-798
vendor: Peppermint-Lab
product: peppermint
affected:
  - peppermint <= 0.5.5
published: '2026-09-03'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:20:21.673'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85391'
references:
  - url: 'https://github.com/Peppermint-Lab/peppermint'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/lib/jwt.ts
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/docker-compose.yml'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Peppermint-Lab/peppermint/issues/528'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/peppermint-through-0.5.5-use-of-hard-coded-jwt-signing-secret-in-docker-compose-yml
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-03T19:00:41.202751Z'
ingestedAt: '2026-09-14T11:00:27.211Z'
epss: 0.00641
epssPercentile: 0.48441
---

## Overview

Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.