PyPI/lollms CVE-2026-1114: critical 9.8, EPSS 0.54%
In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing JSON Web Tokens (JWT). This vulnerabilit
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 2.1.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2026-170
- https://github.com/parisneo/lollms/commit/a3b2b82b84d537a9da63e63a370a6a8ad55fed34
- https://huntr.com/bounties/608b2a3b-2225-438e-9e61-ffbfdec2ed89
- https://github.com/advisories/GHSA-9296-v3fr-j92j
CVE-2026-1114 · published · modified · JSON