CVE-2025-14261: Litmuschaos Litmus

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

The Litmus platform uses JWT for authentication and authorization, but the secret being used for signing the JWT is only 6 bytes long at its core, which makes it extremely easy to crack.

Affected products

• Litmuschaos Litmus: before 3.23.0 (fixed in 3.23.0)

Published 2025-12-08. Last modified 2026-10-07.