CVE-2025-14261
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:HSummary
CVE-2025-14261 is a high-severity Insufficient Entropy (CWE-331) vulnerability in Jfrog (inferred from references). Its CVSS base score is 7.1 (High).
Operationally, ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-201794
Vulnerability Data
The Litmus platform uses JWT for authentication and authorization, but the secret being used for signing the JWT is only 6 bytes long at its core, which makes it extremely easy to crack.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires proper cryptographic key generation and management with sufficient strength/entropy, which the 6-byte JWT secret violates.
Mandates management of authenticators (including secrets and tokens) to ensure they meet strength and complexity requirements, blocking weak JWT signing keys.
Requires use of cryptography meeting federal standards for protecting authentication data, which a trivially crackable JWT secret fails to satisfy.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices explicitly include vetted RNG and entropy sources, directly preventing this weakness while covering many other development concerns.
Password-strength policies implicitly require sufficient entropy, but the control addresses authentication rather than algorithmic randomness.
Proper encryption for data-at-rest requires sufficient entropy for keys/nonces; eliminating the weakness therefore supports but does not fully realize the control.
Cryptographic protection of data-in-transit depends on adequate entropy; the weakness directly undermines the control's effectiveness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandates use of cryptography that must rely on sufficient entropy sources.
Security testing can detect insufficient-entropy defects before release.
Secure-SDLC activities include entropy validation during design and testing.
Secure-coding rules can explicitly forbid weak random-number generation.
Requires secure authentication mechanisms that depend on unpredictable secrets.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Oracle Linux 8 (1 rule)
- V-248524 OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. via CWE-331
RHEL 8 (1 rule)
- V-230223 RHEL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. via CWE-331