CVE-2023-27584
Critical · 9.8Dragonfly2 has hard coded cyptographic key
CVSS
9.8
EPSS
33.9%
Published
Sep 19, 2024
CISA due date
—
The record
Hello dragonfly maintainer team, I would like to report a security issue concerning your JWT feature.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | d7y.io/dragonfly/v2 | 0 | 2.1.0-beta.1 |
| Go | d7y.io/dragonfly/v2 | 0 | 2.0.9-rc.2 |
| Go | d7y.io/dragonfly/v2 | 2.1.0-alpha.0 | 2.1.0-beta.1 |
| go | d7y.io/dragonfly/v2 | 2.1.0-alpha.0 | 2.1.0-beta.1 |
Related vulnerabilities
- GO-2026-4356 Dragonfly Manager Job API Unauthenticated Access in d7y.io/dragonfly Also affects d7y.io/dragonfly/v2
- CVE-2026-24124 Dragonfly is an open source P2P-based file distribution and image acceleration system. Also affects d7y.io/dragonfly/v2
- CVE-2026-79735 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-78486 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-78481 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-53939 OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption… CWE-321
- CVE-2026-81821 The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards… CWE-321
- CVE-2026-80057 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321