Peppermint-Lab vulnerabilities
We track 3 vulnerabilities in Peppermint-Lab products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 3, 2026.
Latest Peppermint-Lab vulnerabilities
- 9.8 Critical severity
peppermint: Use of Hard-coded Credentials
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access
- 8.8 High severity
Peppermint: Improper Access Control
A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no
- 8.1 High severity
Peppermint: Improper Access Control
A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installat