What is GHSA-m3mq-f375-5vgh?

GHSA-m3mq-f375-5vgh is a security advisory published by GitHub Security Advisories with Low severity. Vantage6 Server JWT secret not cryptographically secure

Which CVE IDs does GHSA-m3mq-f375-5vgh cover?

GHSA-m3mq-f375-5vgh covers the following CVE IDs: CVE-2025-43866. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-m3mq-f375-5vgh?

GHSA-m3mq-f375-5vgh affects 1 product, including: pip/vantage6-server:\u003c 4.11.0.

GHSA-m3mq-f375-5vghLow

Vantage6 Server JWT secret not cryptographically secure

Vendor

GitHub Security Advisories

Published

June 12, 2025

Last Modified

June 8, 2026

🔗 CVE IDs covered (1)

CVE-2025-43866 →

📋 Description

Impact

The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent

Patches

Workarounds

You may define JWT secret key in the server configuration file

🎯 Affected products1

pip/vantage6-server:< 4.11.0

🔗 References (5)

https://github.com/vantage6/vantage6/security/advisories/GHSA-m3mq-f375-5vgh
https://nvd.nist.gov/vuln/detail/CVE-2025-43866
https://github.com/vantage6/vantage6/commit/e39a262faf1cd4c554bf1b8e57eeea082da995c0
https://github.com/pypa/advisory-database/tree/main/vulns/vantage6-server/PYSEC-2025-221.yaml
https://github.com/advisories/GHSA-m3mq-f375-5vgh