CVE-2025-49001
Critical · 9.8CVSS
9.8
EPSS
21.8%
Published
Jun 3, 2025
CISA due date
—
The record
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take effect successfully, so a user can use any secret to forge a JWT token. The vulnerability has been fixed in v2.10.10. No known workarounds are available.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|