CVE-2025-15598 | Dataease SQLBot up to 1.5.1 JWT Token auth.py validateEmbedded signature verification

A vulnerability classified as problematic has been found in Dataease SQLBot up to 1.5.1. This impacts the function validateEmbedded of the file backend/apps/system/middleware/auth.py of the component JWT Token Handler. Performing a manipulation results in improper verification of cryptographic signature.

This vulnerability is identified as CVE-2025-15598. The attack can be initiated remotely. Additionally, an exploit exists.

A comment in the source code warns users about using this feature. The vendor was contacted early about this disclosure.