What is the CVSS score of CVE-2026-33746?

CVE-2026-33746 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Panel are affected by CVE-2026-33746?

ConveyPanel versions 3.9.0-beta through 4.5.0 contain a critical JWT signature verification bypass that allows unauthenticated attackers to forge authentication tokens and impersonate any user,…. A patch is available.

How to fix or mitigate CVE-2026-33746?

Within 24 hours: Identify all instances of ConveyPanel in use and confirm current version via admin console or API. Within 7 days: Upgrade to ConveyPanel 4.5.1 or later (patch available per vendor advisory); if immediate upgrade is not feasible, implement network segmentation to restrict access to ConveyPanel admin interfaces to trusted IP ranges only. Within 30 days: Conduct a comprehensive audit of JWT token generation and validation logic; review authentication logs for suspicious token usage patterns during the vulnerability window; reset all user session tokens to invalidate any potentially forged credentials.

Panel CVE-2026-33746

EUVD-2026-18354 CRITICAL

Improper Authentication (CWE-287)

2026-04-02 GitHub_M

Authentication Bypass Panel

9.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 17:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:47 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.5.1

EUVD ID Assigned

Apr 02, 2026 - 16:00 euvd

EUVD-2026-18354

Analysis Generated

Apr 02, 2026 - 16:00 vuln.today

CVE Published

Apr 02, 2026 - 15:06 nvd

CRITICAL 9.8

DescriptionCVE.org

Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signer via lcobucci/jwt, it only validated time-based claims (exp, nbf, iat) using the StrictValidAt constraint. The SignedWith constraint was not included in the validation step. This means an attacker could forge or tamper with JWT token payloads - such as modifying the user_uuid claim - and the token would be accepted as valid, as long as the time-based claims were satisfied. This directly impacts the SSO authentication flow (LoginController::authorizeToken), allowing an attacker to authenticate as any user by crafting a token with an arbitrary user_uuid. This issue has been patched in version 4.5.1.

AnalysisAI

JWT signature verification bypass in ConvoyPanel 3.9.0-beta through 4.5.0 allows unauthenticated remote attackers to forge authentication tokens and impersonate any user account. The JWTService::decode() method validates only time-based claims while ignoring cryptographic signatures, enabling complete authentication bypass in the SSO flow by crafting tokens with arbitrary user_uuid values. CVSS 9.8 (Critical) with network attack vector, low complexity, and no privileges required. No public exploit identified at time of analysis, though the vulnerability mechanism is straightforward to exploit given the technical details in the GitHub advisory.

Technical ContextAI

This vulnerability affects ConvoyPanel (cpe:2.3:a:convoypanel:panel), a KVM server management panel for hosting businesses. The flaw stems from improper JWT token validation implementation using the lcobucci/jwt library. While the JWTService::decode() method correctly configures an HMAC-SHA256 symmetric signer, the validation step applies only the StrictValidAt constraint (checking exp, nbf, iat timestamp claims) without including the SignedWith constraint that verifies cryptographic integrity. This represents a classic instance of CWE-287 (Improper Authentication) where authentication logic fails to validate the authenticity of credentials. In JWT architecture, the signature is the cryptographic proof that the token was issued by a trusted authority and has not been tampered with-omitting signature verification completely negates the security model. An attacker needs only to construct a syntactically valid JWT with appropriate timestamps and can set any user_uuid claim value, bypassing the entire authentication mechanism in the SSO LoginController::authorizeToken flow.

RemediationAI

Vendor-released patch: version 4.5.1 resolves this vulnerability by implementing proper JWT signature verification in the JWTService::decode() method. Immediate upgrade to ConvoyPanel version 4.5.1 or later is required for all affected installations (3.9.0-beta through 4.5.0). Download the patched release from the official GitHub repository at https://github.com/ConvoyPanel/panel/releases/tag/v4.5.1 and follow standard upgrade procedures. Review the security advisory at https://github.com/ConvoyPanel/panel/security/advisories/GHSA-92pg-3w49-4w5x for complete technical details. No workarounds exist for this authentication bypass-signature verification cannot be added through configuration changes and requires code-level fixes. After patching, administrators should audit authentication logs for anomalous successful logins during the vulnerability window, rotate JWT signing secrets if feasible, and review user account activities for signs of unauthorized access or privilege escalation.