Seyong Kim

**Name of the Vulnerable Software and Affected Versions** clawvet self-hosted API server (apps/api) versions prior to 0.7.5 **Description** The software contains a hard-coded fallback JWT (JSON Web Token) secret in `auth.ts` and provides it as the default in `.env.example`. An unauthenticated remote attacker can exploit this by first accessing the 'GET /api/v1/scans' endpoint to harvest `userId` values. Using the known secret, the attacker can forge a valid HS256 `cg session` cookie offline and subsequently call the 'GET /api/v1/auth/me' endpoint to retrieve a victim's email address, subscription plan, and secret `apiKey`. **Recommendations** Update clawvet self-hosted API server (apps/api) to version 0.7.5 or later.