Vulnerabilities

TI-2025-13034 CVE-2025-14261 · GHSA-836x-3v5w-54f3

Lack of entropy allows registered low-privileged users of Litmus to crack valid JWT tokens and gain admin privileges

LOW 31

The Litmus platform uses JWT for authentication and authorization, but the secret being used for signing the JWT is only 6 bytes long at its core, which makes it extremely easy to crack.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00321 Published 2025-12-08 Fixed in 3.23.0 CWE-331

TI-2025-08048 CVE-2025-8797 · GHSA-qf54-2xq3-q6v8

LitmusChaos Litmus LocalStorage permission

MEDIUM 57

A vulnerability was found in LitmusChaos Litmus up to 3.19.0 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00587 Published 2025-08-10 No fix listed CWE-266

TI-2025-08047 CVE-2025-8796 · GHSA-3fpx-64j2-m33g

LitmusChaos Litmus Delete Request delete_project authorization

MEDIUM 57

A vulnerability has been found in LitmusChaos Litmus up to 3.19.0 and classified as problematic.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00433 Published 2025-08-10 No fix listed CWE-862

TI-2025-08046 CVE-2025-8795 · GHSA-qqx5-rxfw-q347

LitmusChaos Litmus login access control

MEDIUM 57

A vulnerability, which was classified as critical, was found in LitmusChaos Litmus up to 3.19.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00478 Published 2025-08-10 No fix listed CWE-266

TI-2025-08045 CVE-2025-8794 · GHSA-2g5h-j52x-gmg7

LitmusChaos Litmus LocalStorage authorization

MEDIUM 55

A vulnerability, which was classified as problematic, has been found in LitmusChaos Litmus up to 3.19.0.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00273 Published 2025-08-10 No fix listed CWE-285

TI-2025-08044 CVE-2025-8793 · GHSA-3w8q-3783-r4v7

LitmusChaos Litmus resource injection

MEDIUM 57

A vulnerability classified as problematic was found in LitmusChaos Litmus up to 3.19.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00484 Published 2025-08-10 No fix listed CWE-99

TI-2025-08043 CVE-2025-8792 · GHSA-fxg2-xhj7-rmc7

LitmusChaos Litmus client-side enforcement of server-side security

MEDIUM 57

A vulnerability classified as problematic has been found in LitmusChaos Litmus up to 3.19.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01143 Published 2025-08-10 No fix listed CWE-602

TI-2025-08042 CVE-2025-8791 · GHSA-p9cp-m8pc-4xxw

LitmusChaos Litmus list_projects improper authorization

MEDIUM 57

A vulnerability was found in LitmusChaos Litmus up to 3.19.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00385 Published 2025-08-10 No fix listed CWE-266

Vulnerabilities

Filters