CVE-2025-55449
High · 7.3CVSS
7.3
EPSS
0.3%
Published
May 8, 2026
CISA due date
—
The record
AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | astrbot | 0 | 3.5.18 |
Related vulnerabilities
- GHSA-4m32-cjv7-f425 AstrBot is vulnerable to RCE with hard-coded JWT signing keys Same vulnerability
- GHSA-vm2f-46xc-5jc3 AstrBot has an arbitrary file read vulnerability in function _encode_image_bs64 Also affects astrbot
- GHSA-xrj9-mw57-j34v AstrBot contains a directory traversal vulnerability Also affects astrbot
- CVE-2025-57697 AstrBot has an arbitrary file read vulnerability in function _encode_image_bs64 Also affects astrbot
- CVE-2025-57698 AstrBot contains a directory traversal vulnerability Also affects astrbot
- CVE-2026-79735 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-78486 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-78481 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321