Use_Of_Hardcoded_Password @ /webgoat-lessons/jwt/src/main/resources/js/jwt-refresh.js

[AASMACMX]

Use_Of_Hardcoded_Password issue exists @ jwt-refresh.js in branch main

The application uses the hard-coded password "bm5nhSkxCXZkKRy4" for authentication purposes, either using it to verify users' identities, or to access another remote system. This password at line 10 of /webgoat-lessons/jwt/src/main/resources/js/jwt-refresh.js appears in the code, implying it is accessible to anyone with source code access, and cannot be changed without rebuilding the application.

Namespace: CxDemoInABoxRepos
Repository: Java-Webgoat
Repository Url: https://github.com/CxDemoInABoxRepos/Java-Webgoat
CxAST-Project: CxDemoInABoxRepos/Java-Webgoat
CxAST platform scan: 466e73ae-3cc9-415a-8383-b7e20e1af3be
Branch: main
Application: Java-Webgoat
Severity: LOW
State: TO_VERIFY
Status: RECURRENT
CWE: 259
Lines: 10

---

References
Read more