Overview
CVE-2025-45746 is a critical cybersecurity vulnerability in ZKT ZKBio CVSecurity version 6.4.1_R, a popular biometric security solution used globally. This vulnerability allows an unauthenticated attacker to exploit a hardcoded JSON Web Token (JWT) secret and gain unauthorized access to the service console. It’s a serious issue that could lead to potential system compromise or data leakage, affecting a wide range of organizations using this software for their security measures. Cybersecurity personnel and IT managers should pay immediate attention to this vulnerability and take appropriate actions to mitigate its potential consequences.
Vulnerability Summary
CVE ID: CVE-2025-45746
Severity: Critical (CVSS 9.8)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Unauthorized system access, potential system compromise, and data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
ZKT ZKBio CVSecurity | 6.4.1_R
How the Exploit Works
An attacker exploits this vulnerability by crafting a JWT token using the hardcoded secret embedded in the ZKT ZKBio CVSecurity software. The crafted JWT token is then used to authenticate to the service console, bypassing the standard authentication procedures. Since the JWT secret is hardcoded, it is the same for all installations of the affected version, making it an easy target for a wide-ranging attack.
Conceptual Example Code
Below is a conceptual example of how the vulnerability might be exploited. This sample HTTP request demonstrates how an attacker might send a forged JWT token to the console’s authentication endpoint:
POST /console/authenticate HTTP/1.1
Host: target.example.com
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1bmF1dGhvcml6ZWRVc2VyIn0.ZKT_HARDCODED_JWT_SECRET
{ "username": "unauthorizedUser" }Note: The actual malicious payload will depend on the specific implementation details of the target system and the malicious intent of the attacker.
Mitigation
The most effective way to mitigate this vulnerability is to apply the patch provided by the vendor. If the patch is not immediately available or cannot be applied for any reason, a temporary mitigation measure could be to use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to block or flag traffic that appears to be exploiting this vulnerability. It is also strongly recommended to review the implementation of the JWT authentication system and avoid using hardcoded secrets in the software design.