Clawvet API Secret Flaw Risks User Data

A critical security vulnerability has been identified within the clawvet self-hosted API server, specifically affecting versions prior to 0.7.5. This oversight involves the inclusion of a hard-coded fallback JWT secret that ships by default with the software.

The Hard-Coded Secret Exposure

The core of the issue lies in the auth.ts file, which contains the string 'clawvet-dev-secret-change-me'. This same default value is also provided in the .env.example file included with the installation. Because the server defaults to this known secret, it creates a predictable entry point for unauthorized access.

Unauthorized Data Harvesting Path

The flaw is compounded by the behavior of the GET /api/v1/scans endpoint, which returns records containing userId values without requiring any authentication. An attacker can leverage this to obtain a victim's user ID, then use the known secret to forge a valid HS256 cg_session cookie offline.

Access to Sensitive Account Details

Once an attacker has forged this session cookie, they can authenticate against the GET /api/v1/auth/me endpoint. This interaction allows an unauthenticated party to retrieve the victim's email address, their current subscription plan, and their secret apiKey.

• Advisory ID: GHSA-xrvw-c6vh-v4r5
• CVE Identifier: CVE-2026-62241
• CVSS Severity Score: 9.1

The scope of this vulnerability is limited to the self-hosted API server components (apps/api). According to the advisory, the published clawvet npm package, which serves as the CLI tool, is not affected by this security concern.

Operational Security Implications

The discovery of this hard-coded secret suggests that any deployment using the default configuration is susceptible to data exposure. For organizations currently hosting the affected API, this indicates that internal scan records and linked user account metadata may be accessible to anyone capable of discovering the public-facing endpoint. The ability to harvest API keys through this method implies that downstream services authenticated by those keys may also be at risk of unauthorized use.