SOCFortress CoPilot shipped a hardcoded JWT signing secret that is used when an environment variable is not supplied. An unauthenticated attacker can request the application to sign tokens with this known value, then forge arbitrary admin‑scoped JWTs. By doing so, the attacker gains unrestricted administrative access to the CoPilot interface and to every security tool integrated with it, enabling further lateral movement across the security operations environment.

The vulnerability exists in all CoPilot releases prior to 0.1.57, particularly where "JWT_SECRET" is not explicitly configured. Default Docker‑Compose deployments that rely on the provided .env.example are especially affected. Any installation that deploys these older versions without overriding the hardcoded secret is at risk.

With a CVSS score of 10 the vulnerability is considered critical. The EPSS score is not available, but the lack of any authentication requirement makes exploitation trivial for an attacker with network or web access. The vulnerability is not listed in CISA KEV yet, yet the ability to forge tokens means an attacker can gain full control of the application without material effort. The likely attack vector is the application’s authentication endpoint, where crafted JWTs can be submitted and accepted unconditionally.