An unauthenticated token generation flaw in yeti-platform yeti before 2.1.12 allows attackers to forge valid JSON Web Tokens and bypass authentication.

The application fails to enforce a unique cryptographic secret for JWT generation when the default configuration remains unmodified, allowing unauthenticated attackers to construct arbitrary valid session tokens.

A successful exploitation of this flaw grants unauthorized access to sensitive application resources and user data without requiring valid credentials. Because the attack vector is network-based and requires no user interaction, it poses a severe threat to confidentiality and access control. This risk profile aligns with the high CVSS score of 7.5, which underscores the potential for complete authentication bypass.

Immediate Action: Update yeti to version 2.1.12 or later, and immediately change the default YETI_AUTH_SECRET_KEY to a secure and unique value.

Proactive Monitoring: Monitor authentication logs for sudden spikes in administrative access or anomalous token generation patterns originating from unexpected IP addresses.

Compensating Controls: Deploy a Web Application Firewall rule to inspect and block anomalous authorization headers or unexpected token structures entering the environment.

Public Exploit Available: No

Organizations utilizing yeti-platform yeti prior to version 2.1.12 must treat this vulnerability with high priority. Administrators should update the software immediately and ensure that all default cryptographic secrets are rotated to prevent token forgery and unauthorized system access.