CVE-2025-47945

CRITICAL 9.8CVE-2025-47945 · Published 17/05/2025 · updated 17/06/2026

In short

CVE-2025-47945 is a CRITICAL (CVSS 9.8) vulnerability affecting donetick (donetick).
Chance of exploitation in the next 30 days (EPSS): 0.69%, higher than 52.7% of all vulnerabilities.
Fix: update to 0.1.44 or later.

Package	Affected versions	Patched versions
donetick donetick	`< 0.1.44`	`0.1.44`

Description

Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens (JWT) for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to change it, this approach is inadequate. The vulnerability is proven by existence of the issue in the live version as well. This issue can result in full account takeover of any user. Version 0.1.44 contains a patch.

References

donetick/donetick commit 620b897 · Patch
donetick/donetick commit b9a6e17 · Patch
donetick/donetick security advisory · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free