EUVD-2026-45085
GHSA-xrvw-c6vh-v4r5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, low-complexity forgery of any user's session against default config gives PR:N/AC:L; full account impersonation and apiKey theft yield C:H and I:H, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated attacker can harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known secret, and call GET /api/v1/auth/me to obtain the victim's email address, subscription plan, and secret apiKey. The published clawvet npm package (CLI only) is not affected.
Articles & Coverage 1
AnalysisAI
Session forgery in the clawvet self-hosted API server (apps/api) before 0.7.5 lets a remote unauthenticated attacker fully impersonate any user and steal their secret apiKey. The server ships a hard-coded fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and .env.example, while an unauthenticated GET /api/v1/scans endpoint leaks victim userId values; combining these, an attacker forges a valid HS256 cg_session cookie offline and calls GET /api/v1/auth/me to exfiltrate the victim's email, subscription plan, and API key. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the technique is fully described and trivially reproducible; only the self-hosted API is affected, not the published clawvet npm CLI package.
Technical ContextAI
clawvet is a Node.js/TypeScript application; the vulnerable component is its self-hosted REST API server (apps/api) which issues stateless JSON Web Token session cookies (cg_session) signed with HS256. The root cause maps to CWE-306 (Missing Authentication for Critical Function): the token-verification logic in auth.ts falls back to a static, publicly-known secret string when no environment secret is configured, and that same value is shipped as the default in .env.example, so any deployment left on defaults uses a secret every attacker already knows. HS256 is a symmetric algorithm, meaning knowledge of the signing secret is sufficient to mint arbitrarily valid tokens offline. Compounding this, the GET /api/v1/scans route returns scan records that embed userId values without requiring authentication, supplying the exact subject identifier an attacker needs to forge a session for a specific victim. The affected package per CPE is cpe:2.3:a:mohibshaikh:clawvet, and the CLI-only npm distribution does not include this server code.
RemediationAI
Upgrade the self-hosted API server to clawvet 0.7.5 or later, which is the vendor-released patch that removes the hard-coded fallback JWT secret; see GHSA-9mww-p953-jfc9 (https://github.com/MohibShaikh/clawvet/security/advisories/GHSA-9mww-p953-jfc9). If you cannot patch immediately, the highest-value compensating control is to set a strong, unique random JWT signing secret via the environment (never leave the value from .env.example) and restart the service, which defeats offline cookie forgery; note that rotating the secret invalidates all existing sessions and forces users to re-authenticate. Additionally, place authentication in front of or otherwise restrict GET /api/v1/scans so it no longer returns userId values to anonymous callers - this removes the identifier an attacker needs to target a specific victim, with the trade-off that any client relying on unauthenticated scan listing will break. Because the apiKey may already be exposed, treat existing user API keys and sessions as compromised and rotate them after upgrading.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today