CVE-2024-46508
High
Description
yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other than SECRET).
SeverityHigh
CVSS7.5
Exploit probability—
ProductYeti
PublishedMay 8, 2026
First seenMay 8, 2026
Weakness typeCWE-798Hard-coded credentials
How to fix
Update
- yeti-platform yeti2.1.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yeti-platform yeti | 2.0 ≤ v < 2.1.12 | 2.1.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.