CVE-2023-5074: D-Link D-View 8 static JWT key allows authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or interaction required, an authentication bypass, and public exploit references make this an urgent patch.

What it is

D-Link D-View 8 v2.0.1.28 uses a static key to protect the JWT token used for user authentication, so the token can be forged. Because the key never changes, anyone who learns it can mint valid tokens and bypass authentication entirely.

Impact

An attacker gains full authenticated access to the application without credentials, with high impact to confidentiality, integrity and availability per the CVSS vector.

Attack surface

Reachable over the network with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). The flaw sits in the JWT authentication mechanism itself, so the login path is the entry point.

Exploitation

Not listed in CISA KEV, but EPSS is 0.679 (99.3rd percentile) and both references are tagged Exploit, indicating public exploit material exists and exploitation is likely.

What to do

• Upgrade D-View 8 past v2.0.1.28 to a vendor-fixed release; confirm the fixed version with D-Link since the record does not name one.
• If patching cannot be done immediately, isolate D-View 8 management interfaces from untrusted networks and restrict access to trusted admin hosts.
• Rotate or replace the static JWT signing key and invalidate existing tokens if the product allows key configuration.
• Monitor D-Link advisories for this CVE and apply vendor guidance as it is released.

Detection

• Search authentication logs for successful logins or API calls with JWTs that do not correspond to a real user session or login event.
• Alert on JWT signatures or claims that validate against the known static key rather than per-install secrets.
• Baseline normal D-View 8 admin source IPs and flag authentication from unexpected hosts.
• Watch for anomalous administrative actions performed without a preceding credential-based login.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.