This vulnerability arises from a hardcoded JWT signing secret embedded in the docker-compose.yml file of Peppermint. An attacker who can access the publicly available source code can retrieve this secret and use it to generate valid JSON Web Tokens for any user ID. The forged tokens grant the attacker the same level of access as an authenticated user, enabling unauthorized use of protected endpoints and potential data theft or manipulation. The CVSS score of 9.3 marks it as a high‑severity flaw that can be exploited without any authentication.

The issue affects the Peppermint open‑source project maintained by Peppermint‑Lab, specifically versions up through and including 0.5.5. Users running any of these releases are exposed to the risk of token forgery because the secret is stored in plain text within the docker-compose configuration.

Given the lack of an EPSS value, the exploit probability is not quantified, but the flaw is trivial to exploit: the secret is in a public repository and can be read by anyone. The CVSS score indicates maximum impact, and the vulnerability is not listed in the CISA KEV catalog, though its severity warrants immediate attention. Attackers can achieve full impersonation of any account without interacting with the application or possessing valid credentials.