CVE-2021-27884

Name of the Vulnerable Software and Affected Versions: YMFE YApi versions 1.9.2 and earlier

Description: The issue arises from weak JSON Web Token (JWT) signing secret generation. This is due to the use of Math.random in Node.js, which does not provide cryptographically secure random numbers, allowing the recreation of other users' JWT tokens.

Recommendations: For versions 1.9.2 and earlier, update to version 1.9.3 to resolve the issue. As a temporary workaround, consider restricting access to sensitive operations that rely on JWT tokens until the update can be applied.