CVE-2026-1114

CVE-2026-1114 affects parisneo/lollms versions prior to 2.2.0 and involves a critical session management flaw in JWT implementation. The application uses a weak secret key for signing JSON Web Tokens, enabling attackers to conduct offline brute-force attacks to recover the key and subsequently forge administrative tokens by modifying JWT payloads. The vulnerability carries a CVSS score of 9.8 (Critical) with a network-based attack vector requiring no authentication, user interaction, or special privileges. Once exploited, the flaw grants attackers complete confidentiality, integrity, and availability compromise through unauthorized administrative access and privilege escalation to restricted endpoints. Current exploitation status indicates the vulnerability is not being actively exploited in the wild, with no known public exploit code readily available. The vulnerability carries a low EPSS score of 0.000190000 and is not included on the CISA Known Exploited Vulnerabilities catalog, suggesting minimal community attention and exploitation attempts at this time. Organizations running lollms should prioritize upgrading to version 2.2.0 to remediate this critical issue.