CVE-2025-26340

A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to bypass the authentication via crafted HTTP requests.

A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to bypass the authentication via crafted HTTP requests.

Un CWE-321 "Uso de clave criptográfica codificada" en la firma JWT en Q-Free MaxTime menor o igual a la versión 2.11.0 permite a un atacante remoto no autenticado eludir la autenticación mediante solicitudes HTTP manipulado.