CVE-2026-62241
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The clawvet self-hosted API server before version 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as default in .env.example. Additionally, GET /api/v1/scans returns scan records containing userId values without authentication, allowing a remote unauthenticated attacker to harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known secret, and call GET /api/v1/auth/me to obtain the victim's email address, subscription plan, and secret apiKey.
Risk Assessment
The organization is at risk of user credential theft (email, API key) and exposure of sensitive subscription information, potentially leading to unauthorized account access and further system compromise.
Recommendation
Immediately upgrade the clawvet API server to version 0.7.5 or later and replace the default JWT secret with a strong, unique key in production configuration.
Original NVD description (English source)
clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated attacker can harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known secret, and call GET /api/v1/auth/me to obtain the victim's email address, subscription plan, and secret apiKey. The published clawvet npm package (CLI only) is not affected.