CVE-2026-85295

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.3

Description Four authentication helpers in the API and socket layer accept session JSON Web Tokens (JWT) signed with CB SECRET, including known, weak, or default values. This occurs within the session JWT fallback in server/modules/verifyToken.js, verifyUser.js, getUserFromToken.js, and socketManager.js. An attacker who knows the symmetric secret can forge an HS256 token to impersonate any target user ID, bypassing password and two-factor authentication to gain full account takeover and exercise the user's privileges across the entire application. This issue specifically affects stock source or repository Docker Compose deployments that retain the default CB SECRET, as well as any installation using a known or weak secret. Bare containers where CB SECRET is undefined are not affected.

Recommendations Update to version 5.2.3. Rotate the CB SECRET to invalidate all current sessions and forged tokens, ensuring that no deployment uses the shipped default value.