CVE-2025-55449
HIGH 7.3EPSS 0.3%
AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.
- CVSS v3.1 CNA
- 7.3 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS v3.1 GitHub
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.28% chance of exploitation in the next 30 days, 19th percentile
- Published
- 2026-05-08
Proof-of-concept exploits (2)
- Marven11/CVE-2025-55449-AstrBot-RCE2★ · 2025-11-11
- xhh1h/CVE-2025-554493★ · 2025-12-10