CVE-2023-40171

CVE-2023-40171 is a high-severity vulnerability affecting Netflix Dispatch, an open-source security incident management tool. It allows for the disclosure of the JWT Secret Key in error messages when the Basic Authentication Provider plugin fails to decode a JWT token. This enables an attacker to craft valid JWTs, potentially leading to full account takeover within an affected Dispatch instance. The vulnerability has a CVSS score of 7.5, indicating a network-based attack with low complexity and high confidentiality impact. While a fix is available in the 20230817 release, there are no known workarounds, and there is currently no evidence of active exploitation, public exploit code, or significant community discussion.