The vulnerability in Datavane Datavines allows an attacker to manipulate the tokenSecret argument within the JWT token handler, causing the application to use a hard‑coded cryptographic key. This flaw represents a weakness in key management (CWE-320 and CWE-321) that can enable unauthorized decryption or generation of tokens, potentially exposing sensitive information and granting elevated privileges to the attacker. The impact is a loss of confidentiality and possible unauthorized access.

Datavane Datavines up to commit 13607645e14a4982468cfdbcf75c85cde63bae71 is affected. No specific version list is available because the project uses a rolling release model.

The CVSS score of 6.3 indicates a moderate severity, while the EPSS score of less than 1% points to a very low likelihood of exploitation. The attack vector is remote, but the complexity and difficulty of exploitation are high, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers would need to craft a payload that modifies tokenSecret and trigger the vulnerable code path, which is difficult and not straightforward.