Hardcoded JWT secret and authentication bypass in clawvet API server (CVE-2026-62241)

The clawvet self-hosted API server (apps/api) hard-codes a fallback JWT signing secret ('clawvet-dev-secret-change-me') in source and ships the same value as the default in .env.example. The GET /api/v1/scans endpoint returns scan records including userId values without authentication, enabling a remote unauthenticated attacker to harvest victim userIds and forge valid HS256 cg_session cookies offline using the known secret. Successful exploitation allows the attacker to call GET /api/v1/auth/me and obtain the victim's email address, subscription plan, and secret apiKey with no prior account, victim interaction, or privileged network position required; CVSS 9.1 Critical. Affected versions: - 0.7.1 We recommend updating to: 0.7.5. CVSS 9.3 · our assessment: act_now Vendor advisory: https://github.com/MohibShaikh/clawvet/security/advisories/GHSA-9mww-p953-jfc9 Details: https://vuln.today/cve/CVE-2026-62241