Peppermint-Lab has 2 CVEs on record. 2 were published in the last 90 days. The median CVSS is 7.1 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Worst active — by depth score
CVE-2026-85391Critical· 9.8Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account54CVE-2026-111353Medium· 4.3Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints36
Peppermint-Lab vulnerabilities
CVEs affecting Peppermint-Lab, newest first. Open any entry for full detail, references, and exploit status.
2 CVEsRSS
CVE-2026-111353Medium· 4.3PoCPeppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests…
CVE-2026-85391Critical· 9.8Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitra…