CVE-2026-57183

Name of the Vulnerable Software and Affected Versions Scoold versions prior to 1.69.1

Description The checkApiAuth() function in src/main/java/com/erudika/scoold/utils/ScooldUtils.java allows the use of a JSON Web Token (JWT) signed with app secret key or para secret key for the '/api/config' and '/api/stats' endpoints without requiring a registered API-key jti. This process maps the request to the hardcoded administrative API USER. These endpoint checks remain active even if scoold.api enabled is set to false. An attacker possessing either signing secret can forge a token to access privileged configuration functionality and read sensitive server logs and configuration data.

Recommendations Update to version 1.69.1.