Peppermint through version 0.5.5 contains a hardcoded JWT signing secret stored in docker-compose.yml, exposing it publicly in the repository. Unauthenticated attackers can leverage this published secret to forge valid session tokens for any user account. By minting tokens with arbitrary user IDs, attackers can bypass authentication entirely and access protected API endpoints without valid credentials. The vulnerability requires no prior authentication or special privileges to exploit. The hardcoded secret is referenced in the application's JWT handling code at apps/api/src/lib/jwt.ts. This represents a critical authentication bypass vulnerability affecting all default deployments of Peppermint up to and including version 0.5.5. Organizations using Peppermint should immediately rotate their JWT secrets and upgrade to a patched version. The issue has been reported in the project's GitHub issue tracker and documented by VulnCheck.
