CVE-2026-125758

Name of the Vulnerable Software and Affected Versions Aptabase versions prior to commit 61d4c01

Description An authentication bypass exists that allows unauthenticated attackers to forge sign-in links by utilizing the publicly known example AUTH SECRET. This flaw enables attackers to enumerate registered emails via the '/api/ auth/signin' endpoint, forge HS256 JWTs (JSON Web Tokens, which are open standards for securely transmitting information between parties as a JSON object) redeemed by the '/api/ auth/continue' endpoint, impersonate users, export analytics data, and transfer app ownership.

Recommendations Update Aptabase to commit 61d4c01 or a later version. Change the AUTH SECRET from the example value to a unique, secure secret.