CVE-2025-49151ICS JWT auth bypass via hard-coded constants
What broke
An industrial product covered by CISA ICSA-25-175-07 verified JWTs against hard-coded constants (CWE-547) rather than a real key. Anyone who read the firmware or the advisory can mint a valid token. Critical. Vendor patched.
Why it matters
OT and ICS identity is often "we added JWT in the last firmware." Hard-coded secrets are how that upgrade fails. The same lesson as hard-coded credentials in enterprise SaaS, with a plant-floor blast radius.
What to do
- Apply the firmware named in ICSA-25-175-07.
- Rotate any identity secret that shipped in the image. A patch that leaves the old constant in place is not a fix.
- For any ICS or appliance SSO, ask the vendor where the JWT signing key lives. If the answer is "in the firmware," do not federate it to your corporate IdP.
After you patch
Token-layer flaws produce credentials that keep working after the patch, so remediation is about invalidating what was issued.
- Rotate the signing keys published at your JWKS endpoint, then confirm relying parties refetch on an unknown key id rather than caching indefinitely.
- Revoke refresh tokens and sessions. Access tokens expire on their own; refresh tokens are the ones that turn a short compromise into months of access.
- Audit client registrations and consent grants created during the window, particularly any client with broad scopes or a redirect URI you do not recognize.
- Verify validation on your side: pinned algorithms, issuer and audience checks, and no acceptance of
alg: none. See JWT and the validate a JWT recipe.
Sources
- NVD: CVE-2025-49151
- CISA ICSA-25-175-07
Related identity CVEs
Related on Start with Identity
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- CVEAuth0 node-jws HS256 verification bypass via secret lookup
node-jws before 3.2.3 / 4.0.1 can accept an HS256 JWT when the caller looks up the secret from attacker-controlled input. Medium on paper, but it is a signature
- GlossaryClaims
Statements about a subject carried in a token, such as subject identifier, email, roles, or expiry. Relying parties make authorization decisions from claims, so
- GlossaryID Token
A JWT issued by an OpenID Connect provider that conveys authentication claims about the user. Unlike access tokens, ID tokens are intended for the client, not f
- CVESharePoint JWT alg:none, impersonate any user
SharePoint's ReadTokenCore skipped signature checks when the JWT header said alg:none. An unauthenticated attacker became any user, including farm admin. CVSS 9
- CVESharePoint JWT validation chain, forge a token and become any user
Four weaknesses across two SharePoint JWT token handlers chain into an unauthenticated authentication bypass. Rapid7 published a proof of concept in August 2026