# CVE-2025-43866: Vantage6 Server insufficiently random JWT secret key

Source: https://junglewise.ai/threats/cve-2025-43866-vantage6-server-insufficiently-random-jwt-secret-key  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-06-12. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2025-43866 · Severity: medium · CVSS 4 · Published 2025-06-12

Vantage6 is an open-source platform used for privacy-preserving data analysis. A security issue was identified where the server's default security keys (JWT secrets) are generated using a predictable method if not manually configured by the user. This could potentially allow an attacker to guess the security key, leading to unauthorized access or the ability to forge authentication tokens.

Technologies: [vantage6-server (PyPI)](https://junglewise.ai/threats/technologies/vantage6-server). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-43866 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-43866 being exploited in the wild.

**How severe is CVE-2025-43866?** Medium severity, with a CVSS score of 4, published 12 June 2025.

**Which products and versions are affected?** vantage6-server (PyPI) < 4.11.0, ECOSYSTEM:introduced=0,fixed=4.11.0.

**Is there a fix for CVE-2025-43866?** Yes. vantage6-server (PyPI): upgrade to 4.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-43866 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-43866?** Check whether you run vantage6-server (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vantage6-server (PyPI): upgrade to 4.11.0 or later

  ```sh
  pip install "vantage6-server>=4.11.0"
  ```


## Technical details

The vantage6-server component uses Python's `uuid.uuid1()` to auto-generate a `JWT_SECRET_KEY` when one is not explicitly provided in the configuration. Because UUID1 is based on the host's MAC address and the current timestamp, it is not cryptographically secure and is partially predictable. An attacker who can predict the secret key could forge JSON Web Tokens (JWTs) to bypass authentication or escalate privileges. The vulnerability is classified as CWE-330 (Use of Insufficiently Random Values) and has been addressed in version 4.11.0 by switching to a more secure random generator.

## Affected products

- vantage6 vantage6-server < 4.11.0

## Identifiers

- CVE-2025-43866
- GHSA-m3mq-f375-5vgh
- PYSEC-2025-221

## Timeline

- 2025-06-12: disclosed
- 2025-06-12: advisory
- 2025-06-12: patched: Fixed in version 4.11.0

## References

- [https://github.com/vantage6/vantage6/security/advisories/GHSA-m3mq-f375-5vgh](https://github.com/vantage6/vantage6/security/advisories/GHSA-m3mq-f375-5vgh)
- [https://github.com/vantage6/vantage6/commit/e39a262faf1cd4c554bf1b8e57eeea082da995c0](https://github.com/vantage6/vantage6/commit/e39a262faf1cd4c554bf1b8e57eeea082da995c0)
- [https://github.com/pypa/advisory-database/tree/main/vulns/vantage6-server/PYSEC-2025-221.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/vantage6-server/PYSEC-2025-221.yaml)
- [https://api.github.com/repos/vantage6/vantage6/security-advisories/GHSA-m3mq-f375-5vgh](https://api.github.com/repos/vantage6/vantage6/security-advisories/GHSA-m3mq-f375-5vgh)

## Related threats

- [PYSEC-2026-2004 - vantage6's CORS settings overly permissive](https://junglewise.ai/threats/cve-2024-23823-vantage6-s-cors-settings-overly-permissive)
- [PYSEC-2026-2008 - vantage6 vulnerable to username timing attack](https://junglewise.ai/threats/cve-2024-21671-vantage6-vulnerable-to-username-timing-attack)
- [PYSEC-2026-2003 - vantage6 has insecure SSH configuration for node and server containers](https://junglewise.ai/threats/cve-2024-21653-vantage6-insecure-ssh-configuration-in-node-and-server-containers)
- [PYSEC-2023-304 - vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC).](https://junglewise.ai/threats/cve-2023-47631-vantage6-server-node-accepts-non-whitelisted-algorithms-from)