CVE-2025-13948 Overview
CVE-2025-13948 affects opsre go-ldap-admin versions up to 20251011. The vulnerability resides in the JWT Handler component and is tied to the shipped docs/docker-compose/docker-compose.yaml file. The configuration exposes a hard-coded cryptographic key used as the JWT secret, mapped to [CWE-320] Key Management Errors. An attacker who obtains or reuses the hard-coded secret can forge valid JSON Web Tokens against deployments that retain the default value. The attack is remote but rated as high complexity, and a public disclosure has been published.
Critical Impact
Attackers with knowledge of the hard-coded JWT secret can forge authentication tokens and impersonate users in go-ldap-admin deployments that keep the default configuration.
Affected Products
- opsre go-ldap-admin up to version 20251011
- Deployments using the shipped docs/docker-compose/docker-compose.yaml
- JWT Handler component of go-ldap-admin
Discovery Timeline
- 2025-12-03 - CVE-2025-13948 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13948
Vulnerability Analysis
The issue is a hard-coded cryptographic key embedded in the go-ldap-admin Docker Compose reference configuration. The JWT Handler uses this shared secret to sign and validate authentication tokens. Because the value is distributed with the project and public on the source repository, any deployment that does not override it uses a secret known to all readers of the code.
An attacker who knows the secret can craft arbitrary JWTs that the server accepts as legitimate. The forged tokens can carry claims for any user identity managed by the LDAP administration interface. Exploitation requires the target to run the default configuration, which is why the exploit complexity is rated as high. The public gist referenced in the advisory documents the disclosure and hard-coded value.
Root Cause
The root cause is Use of Hard-coded Cryptographic Key [CWE-320]. The reference docker-compose.yaml file supplies a static JWT signing secret rather than requiring operators to provide their own value at deploy time. Sensitive material was placed in a distributed configuration artifact instead of being sourced from a secret store or generated on first run.
Attack Vector
The attack vector is network-based. An attacker sends a forged JWT signed with the known secret to the go-ldap-admin API. If the server validates the signature using the hard-coded key, the request is treated as authenticated. No prior credentials or user interaction are required, but the attacker must reach the management interface and the target must retain the default secret.
No verified exploit code is included in this advisory. See the GitHub Gist Resource and VulDB #334163 for the public disclosure details.
Detection Methods for CVE-2025-13948
Indicators of Compromise
- Presence of the default JWT secret value from docs/docker-compose/docker-compose.yaml in a running go-ldap-admin container's environment variables.
- Successful authenticated API calls to go-ldap-admin from unexpected source IPs without a preceding login flow.
- JWTs presented to go-ldap-admin whose iat or sub claims do not correlate with a recorded login event.
Detection Strategies
- Inventory all go-ldap-admin deployments and inspect container configuration for use of the shipped default secret.
- Audit reverse proxy and application logs for authenticated actions that lack a corresponding /login request.
- Compare LDAP administrative changes against a known list of authorized operators to identify unauthorized modifications.
Monitoring Recommendations
- Alert on go-ldap-admin API traffic originating from IP addresses outside expected administrative networks.
- Monitor for privileged LDAP operations (user creation, group membership changes, password resets) outside change windows.
- Track container image and configuration drift so that unmodified default docker-compose.yaml deployments surface for review.
How to Mitigate CVE-2025-13948
Immediate Actions Required
- Replace the JWT secret in every go-ldap-admin deployment with a unique, high-entropy value sourced from a secrets manager.
- Restart the service after rotating the secret so that all previously issued tokens are invalidated.
- Restrict network access to the go-ldap-admin management interface to trusted administrative subnets or a VPN.
- Review recent LDAP directory changes for evidence of unauthorized modifications performed via forged tokens.
Patch Information
No vendor patch is referenced in the NVD entry at the time of publication. Track the project's repository and the VulDB entry for fix availability. Until a fixed release is published, operators must override the default secret in their own configuration.
Workarounds
- Do not deploy the example docs/docker-compose/docker-compose.yaml unmodified; treat it as a template only.
- Inject the JWT secret at runtime via environment variables backed by Docker secrets, Kubernetes Secrets, or an external vault.
- Place go-ldap-admin behind an authenticating reverse proxy that enforces mTLS or SSO to limit exposure of the JWT endpoint.
# Configuration example: override the default JWT secret at deploy time
export GO_LDAP_ADMIN_JWT_SECRET="$(openssl rand -base64 48)"
docker compose -f docker-compose.yaml up -d
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
