CVE-2026-2215 | rachelos WeRSS we-mp-rss up to 1.4.8 JWT core/auth.py SECRET_KEY default key

A vulnerability classified as problematic has been found in rachelos WeRSS we-mp-rss up to 1.4.8. This issue affects some unknown processing of the file core/auth.py of the component JWT Handler. Performing a manipulation of the argument SECRET_KEY results in use of default cryptographic key.

This vulnerability is identified as CVE-2026-2215. The attack can be initiated remotely. Additionally, an exploit exists.