Panel CVE-2026-33746

Convoy versions 3.9.0-beta through 4.5.0. Remote unauthenticated attacker can forge JWT tokens by modifying claims (e.g., user_uuid) since JWTService::decode() validates only time-based claims without cryptographic signature verification. Default installations vulnerable; no special configuration or victim interaction required.

This represents a critical authentication bypass with severe real-world risk. The CVSS 9.8 score accurately reflects the severity: network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and complete impact to confidentiality, integrity, and availability (C:H/I:H/A:H). EPSS data not provided, but the vulnerability characteristics suggest high exploitability-JWT forgery requires only understanding the token structure and crafting valid JSON with appropriate timestamps, no cryptographic knowledge needed since signatures are ignored. The technical impact enables complete account takeover of any user including administrators, allowing attackers full control over managed KVM infrastructure. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the GitHub Security Advisory provides sufficient implementation details that skilled attackers could rapidly develop exploits. The straightforward nature of JWT forgery, combined with the critical position of authentication in security architecture, makes this an immediate patching priority despite absence of observed exploitation. Organizations running affected versions face tangible risk of unauthorized infrastructure access and potential pivot points for broader compromise.

An unauthenticated attacker identifies a ConvoyPanel installation running version 4.5.0 or earlier. By examining legitimate JWT tokens or referencing the public security advisory, the attacker crafts a forged JWT with an arbitrary user_uuid claim corresponding to an administrator account, setting valid exp/nbf/iat timestamps to satisfy time-based constraints. The attacker submits this forged token to the SSO LoginController::authorizeToken endpoint without needing to know or crack the HMAC signing key, since signature verification is not performed. The application accepts the token as valid, granting the attacker full administrative session access to the KVM management panel, enabling control over hosted virtual machines, access to customer data, infrastructure reconfiguration, and potential pivot points for attacking hosted environments.