Raphaël Lob

The issue allows attackers to bypass authentication in the application when deployed using the official Docker image. This is due to a hard-coded secret used to sign the authentication token (JWT), which could enable an attacker to compromise another instance of the application.

The issue is related to an information leakage vulnerability. An attacker with low permissions can view some high-privilege information by running specific commands. Successful exploitation could cause an information disclosure condition.