CVE-2025-49001

CRITICAL NUCLEI

DataEase < 2.10.10 - Improper Authentication via JWT Secret Bypass

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-49001. PoCs published by iSee857. A Nuclei detection template is also available.

AI-analyzed exploit summary The repository contains a functional exploit PoC for CVE-2026-22812, targeting OpenCode with a command execution vulnerability. The script demonstrates RCE by creating a session and executing the 'id' command, verifying the presence of 'uid=' and 'gid=' in the response.

Description

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take effect successfully, so a user can use any secret to forge a JWT token. The vulnerability has been fixed in v2.10.10. No known workarounds are available.

Exploits (1)

github WORKING POC 40 stars

by iSee857 · pythonpoc

https://github.com/iSee857/CVE-PoC/tree/main/DataEase-CVE-2025-49001-JWTByPass.py

View Code ZIP pw:eip

The repository contains a functional exploit PoC for CVE-2026-22812, targeting OpenCode with a command execution vulnerability. The script demonstrates RCE by creating a session and executing the 'id' command, verifying the presence of 'uid=' and 'gid=' in the response.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: OpenCode (version not specified)

No auth needed

Prerequisites: Network access to the target · OpenCode service running on the target

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 27, 2026 Full analysis →

Nuclei Templates (1)

DataEase < 2.10.10 - JWT Authentication Bypass

CRITICALVERIFIEDby YunSeoJo,aryu-ru

Shodan: http.title:"DataEase"

FOFA: title="DataEase"

References (1)

Core 1

Core References

Broken Link x_refsource_confirm

https://github.com/dataease/dataease/security/advisories/GHSA-xx2m-gmwg-mf3r

Scores

CVSS v3 9.8

EPSS 0.0737

EPSS Percentile 91.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-287

Status published

Products (1)

dataease/dataease < 2.10.10

Published Jun 03, 2025

Tracked Since Feb 18, 2026