---

Security Bulletin #26-004 - DriveLock On-Premise: JWT Secret Exposure due to Weak Cryptography

---

---

First published: 2026-04-16

Last updated: 2026-07-06

CVE: Not yet assigned

EUVD: Not yet assigned

CVSS Score: HIGH 8.2 - CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C

Affected product(s): DriveLock SE — DriveLock On-Premise

Affected deployment: DriveLock On-Premise only

DriveLock Cloud: Not affected

Disclosure status: Coordinated

Vulnerability type / classification: Weak Cryptography

Attack type: Remote

Attack vector: Network, requiring highest administrative privileges (Infrastructure_Manage)

---

Summary

If a user already has the highest privileges (Infrastructure_Manage), they can, for example, decrypt the JWT token. This addresses the “Weak Crypto” finding.

Description

In the upcoming 26.1 release, the reported weak cryptography has already been replaced by AES-GCM. Different keys are used for different encryption purposes, such as JWT, API keys, and others.

For older versions, logging has been adjusted so that sensitive data is no longer written to log files.

Affected versions

• DriveLock 24.2 — vulnerable

• DriveLock 25.1 — vulnerable

• DriveLock 25.2 — vulnerable

Mitigation

Update to the patched versions once available.

Fixed in

• DriveLock 24.2

• DriveLock 25.1

• DriveLock 25.2

• DriveLock 26.1

Credits

This vulnerability was discovered by stuxxn working with CCC.

How to update your environment

To ensure continued protection, update to one of the fixed versions listed above. Additionally, we always recommend using the latest available DriveLock release to benefit from ongoing improvements and security enhancements.

---