Executive brief
Peppermint is an open-source issue tracking and help desk solution. The application contains a hardcoded JWT (JSON Web Token) signing secret in its docker-compose.yml configuration file, which is publicly visible in the source code repository. An attacker can use this published secret to forge valid authentication tokens for any user account without needing credentials, gaining full access to the system and all customer data.
Technical details
The vulnerability is a cryptographic key exposure caused by hardcoding the JWT signing secret in the docker-compose.yml file, which is stored in the public GitHub repository. The JWT verification function in apps/api/src/lib/jwt.ts uses this exposed secret (via the SECRET environment variable) to sign and verify tokens. An unauthenticated attacker can extract the secret from the repository, use it to mint valid JWT tokens for arbitrary user IDs, and gain unauthorized access to protected API endpoints without credentials. Peppermint through version 0.5.5 is affected; the project was archived on July 17, 2026, and no patched versions are expected to be released.
Affected products
- Peppermint Lab Peppermint through 0.5.5
Timeline
- 2026-09-03: disclosed