github_osv/GHSA-g897-cgfc-7q8v
Fat Free CRM has fixed token value
`config/initializers/secret_token.rb` in Fat Free CRM before 0.12.1 has a fixed `FatFreeCRM::Application.config.secret_token` value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code.
gitlab/gem/fat_free_crm/CVE-2013-7222
Known Session Secret
In config/initialiers/secret_token.rb a static secret token is defined, with the knowledge of this token an attacker is able to execute arbitrary Ruby code server side.