Looks like you're right, admins will just need to update the JWT secret.

Really curious to see how they kill the existing tokens, and whether admins have tools to easily clear all sessions. On one of the Matrix chats someone suggested that the tokens have a one year expiry date!

Smart move. I'm surprised more instances aren't doing this.

FWIW, right now it seems unlikely that your password was accessible to anyone. Your login cookie may have been taken if you accessed Lemmy on a web browser (apps are likely fine), so you would want to clear your Lemmy cookies and cache once this is over.

But I'm speculating, and changing your password will definitely help!

This seems to be a front-end JavaScript exploit, so theres's a good chance that this is a Lemmy problem, not a Lemmy[dot]world problem. Don't be surprised if the issue starts spreading to other instances.

If I were running a server, I would take it offline until a patch is released (Beehaw did this, to be proactive).