peppermint vulnerabilities
CVEs whose affected-version data names the peppermint package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111353Medium· 4.3PoCPeppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests…
▾ TwilightPeppermint-Lab · peppermintEPSS 0.30%via CVEORG
CVE-2026-85391Critical· 9.8Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitra…
▾ MidnightPeppermint-Lab · peppermintEPSS 0.64%via NVD