Read the docs
TI-2026-00842 Aliases CVE-2026-1114GHSA-9296-v3fr-j92j

Improper Access Control via Weak JWT Token in parisneo/lollms

Priority HIGH 82CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing JSON Web Tokens (JWT). This vulnerability allows an attacker to perform an offline brute-force attack to recover the secret key. Once the secret key is obtained, the attacker can forge administrative tokens by modifying the JWT payload and resigning it with the cracked secret. This enables unauthorized users to escalate privileges, impersonate the administrator, and gain access to restricted endpoints. The issue is resolved in version 2.2.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00514 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed parisneo/lollms (parisneo): 2.2.0lollms (PyPI): 2.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
parisneoparisneo/lollmsbefore 2.2.02.2.0Patch availableCNA
—lollms (PyPI)before 2.2.02.2.0Patch availableGHSA-9296-v3fr-j92j
  • parisneo/lollms Vendorparisneo Affected before 2.2.0 Fixed in 2.2.0 Patch available CNA
  • lollms (PyPI) Vendor— Affected before 2.2.0 Fixed in 2.2.0 Patch available GHSA-9296-v3fr-j92j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lollms:lollms:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableLollms
  • cpe:2.3:a:lollms:lollms:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Lollms

Remediation

  • Fix · CNA parisneo/lollms (parisneo) Fixed in 2.2.0
  • Fix · GHSA-9296-v3fr-j92j lollms (PyPI) Fixed in 2.2.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1114
  2. 2026-10-03 Alias added: GHSA-9296-v3fr-j92j

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2024-05059 Remote Code Execution via Path Traversal in parisneo/lollms CVSS 3.0CRITICAL 9.8
  • TI-2024-04029 Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui CVSS 3.0CRITICAL 9.8
  • TI-2024-04023 Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui CVSS 3.1CRITICAL 9.8
  • TI-2024-03798 Arbitrary Code Execution in parisneo/lollms CVSS 3.0CRITICAL 9.8
  • TI-2024-02196 Arbitrary Upload & Read via Path Traversal in parisneo/lollms-webui CVSS 3.0CRITICAL 9.6
  • TI-2024-02195 Path Traversal leading to Remote Code Execution in parisneo/lollms-webui CVSS 3.1CRITICAL 9.8
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences