{"id":41294,"date":"2025-05-20T18:49:19","date_gmt":"2025-05-20T18:49:19","guid":{"rendered":""},"modified":"2025-09-11T12:12:56","modified_gmt":"2025-09-11T18:12:56","slug":"cve-2025-45746-unauthorized-system-access-via-hardcoded-jwt-secret-in-zkt-zkbio-cvsecurity","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-45746-unauthorized-system-access-via-hardcoded-jwt-secret-in-zkt-zkbio-cvsecurity\/","title":{"rendered":"CVE-2025-45746: Unauthorized System Access via Hardcoded JWT Secret in ZKT ZKBio CVSecurity<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

CVE-2025-45746 is a critical cybersecurity vulnerability in ZKT ZKBio CVSecurity version 6.4.1_R, a popular biometric security solution used globally. This vulnerability allows an unauthenticated attacker to exploit a hardcoded JSON Web Token (JWT) secret and gain unauthorized access to the service console. It’s a serious issue that could lead to potential system<\/a> compromise or data leakage, affecting a wide range of organizations using this software for their security measures. Cybersecurity personnel and IT managers should pay immediate<\/a> attention to this vulnerability and take appropriate actions to mitigate its potential consequences.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-45746
\nSeverity: Critical (CVSS 9.8)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Unauthorized system access<\/a>, potential system compromise, and data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

ZKT ZKBio CVSecurity | 6.4.1_R<\/p>\n

How the Exploit Works<\/strong><\/p>\n

An attacker exploits this vulnerability by crafting a JWT token using the hardcoded secret embedded in the ZKT<\/a> ZKBio CVSecurity software. The crafted JWT token is then used to authenticate to the service console, bypassing the standard authentication<\/a> procedures. Since the JWT secret<\/a> is hardcoded, it is the same for all installations of the affected version, making it an easy target for a wide-ranging attack.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Below is a conceptual example of how the vulnerability might be exploited. This sample HTTP request<\/a> demonstrates how an attacker might send a forged JWT token to the console’s authentication endpoint:<\/p>\n

POST \/console\/authenticate HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/json\nAuthorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1bmF1dGhvcml6ZWRVc2VyIn0.ZKT_HARDCODED_JWT_SECRET\n{ \"username\": \"unauthorizedUser\" }<\/code><\/pre>\n
Note: The actual malicious payload will depend on the specific implementation details of the target system<\/a> and the malicious intent of the attacker.<\/p>\n
Mitigation<\/strong><\/p>\n
The most effective way to mitigate this vulnerability is to apply the patch provided<\/a> by the vendor. If the patch is not immediately available or cannot be applied for any reason, a temporary mitigation measure could be to use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to block or flag traffic that appears to be exploiting this vulnerability<\/a>. It is also strongly recommended to review the implementation of the JWT authentication system<\/a> and avoid using hardcoded secrets in the software design.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview CVE-2025-45746 is a critical cybersecurity vulnerability in ZKT ZKBio CVSecurity version 6.4.1_R, a popular biometric security solution used globally. This vulnerability allows an unauthenticated attacker to exploit a hardcoded JSON Web Token (JWT) secret and gain unauthorized access to the service console. It’s a serious issue that could lead to potential system compromise or […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-41294","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t