CVE-2025-47945
📋 TL;DR
CVE-2025-47945 is a critical authentication bypass vulnerability in Donetick task management software. It allows attackers to forge valid JWT tokens due to a weak default signing secret, potentially leading to full account takeover of any user. All Donetick installations prior to version 0.1.44 are affected unless administrators manually changed the secret.
💻 Affected Systems
- Donetick
📦 What is this software?
Donetick by Donetick
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all user accounts, unauthorized access to all tasks and sensitive data, potential privilege escalation to administrative functions.
Likely Case
Attackers gain unauthorized access to user accounts, manipulate tasks, access sensitive information, and potentially pivot to other systems.
If Mitigated
No impact if proper secret rotation has been performed or patch is applied.
🎯 Exploit Status
Exploitation requires knowledge of the weak default secret or ability to extract it from source code/config files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.1.44
Vendor Advisory: https://github.com/donetick/donetick/security/advisories/GHSA-hjjg-vw4j-986x
Restart Required: Yes
Instructions:
1. Backup current installation. 2. Update to version 0.1.44 via package manager or manual download. 3. Restart Donetick service. 4. Force all users to re-authenticate to invalidate old tokens.
🔧 Temporary Workarounds
Manual JWT Secret Rotation
allChange the JWT signing secret to a strong, random value
# Edit Donetick configuration file
# Set JWT_SECRET to a strong random string (min 32 characters)
# Example: JWT_SECRET=your-strong-random-secret-here
🧯 If You Can't Patch
- Immediately rotate JWT signing secret to a cryptographically strong random value (min 32 characters)
- Force all users to log out and re-authenticate to invalidate existing tokens
🔍 How to Verify
Check if Vulnerable:
Check if JWT_SECRET in configuration matches known weak defaults or is easily guessable. Review source code for hardcoded secrets.Check Version:
donetick --version or check package managerVerify Fix Applied:
Verify version is 0.1.44 or later. Confirm JWT_SECRET is set to a strong, random value not present in previous configurations.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful login from same IP
- Unusual user activity patterns
- Authentication from unexpected locations
Network Indicators:
- Unusual JWT token patterns or signatures
- Authentication requests with manipulated tokens
SIEM Query:
source="donetick" AND (event="authentication" AND result="success") | stats count by src_ip, user | where count > threshold🔗 References
- https://github.com/donetick/donetick/commit/620b897bc0135f6668bb8a5562678104531108eb
- https://github.com/donetick/donetick/commit/b9a6e177eefdc605dedbc5320f0d93d6573d1db6
- https://github.com/donetick/donetick/security/advisories/GHSA-hjjg-vw4j-986x
- https://github.com/donetick/donetick/security/advisories/GHSA-hjjg-vw4j-986x
