Clawvet API Server Vulnerability Exposes User Data via Hard-Coded Secret
A critical vulnerability in clawvet API versions before 0.7.5 allows unauthenticated attackers to forge session cookies and access sensitive user information.
Security researchers have identified a critical vulnerability, tracked as CVE-2026-62241, affecting the clawvet self-hosted API server. The issue stems from a hard-coded fallback JWT secret, 'clawvet-dev-secret-change-me', located in auth.ts and provided as a default in the .env.example file.
An unauthenticated remote attacker can exploit this flaw by harvesting user IDs via the GET /api/v1/scans endpoint. Using the known secret, an attacker can forge HS256-based session cookies to impersonate users, granting them unauthorized access to private data, including email addresses, subscription plans, and secret API keys via the GET /api/v1/auth/me endpoint. The vulnerability carries a CVSS score of 9.1.
Users running clawvet API server versions prior to 0.7.5 are advised to update their software immediately to mitigate this risk. The clawvet npm package, which is limited to CLI functionality, is not affected by this vulnerability.
Sources
- GitHub Security Advisories Original source
Continue Reading
SecurityAlpine's GitLab rebuild after RCE try
Alpine Linux rebuilt its GitLab server and reset passwords after attackers tried to exploit a maximum-severity flaw and it could not rule out code execution.
SecurityLXD, MicroCloud flaw lets clients be impersonated
Canonical patched a maximum-severity LXD and MicroCloud bug that let attackers assume a trusted client's identity without its private key.
SecurityA hands-on way to gauge AI ransomware risk
OWASP volunteers released RAID-AI, a free manual self-assessment that maps AI controls to NIST and CISA frameworks.