The vulnerability arises from the use of a weak secret key to sign JSON Web Tokens in lollms version 2.1.0. Because the key can be recovered through an offline brute‑force attack, an attacker can produce admin‑level tokens by altering the token payload and signing it with the cracked key. This allows unauthorized users to impersonate the administrator and access restricted endpoints, effectively giving them full control over the application. The weakness is a classic example of improper access control (CWE‑284).

The affected product is parisneo lollms version 2.1.0. The flaw was fixed in version 2.2.0. No other versions were listed as impacted.

The CVSS score is 9.8, indicating a high severity. The EPSS score is < 1%, suggesting a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an attacker submitting a forged JWT to the application; this is inferred from the description that the token can be tampered with after the key is compromised. Exploitation requires only knowledge of the cracked key and the ability to send HTTP requests, making the threat practical for actors with moderate expertise.