CVE-2026-64682

Name of the Vulnerable Software and Affected Versions AstroBlocks versions prior to 3.4.0

Description Admin session tokens can be forged because of a mismatched environment variable name and a hard-coded fallback JWT (JSON Web Token) secret. An unauthenticated attacker who knows the public fallback value can create a valid session token with the role variable set to "owner", granting full administrative control over the CMS. This allows the attacker to create or delete content, users, media, redirects, and configuration.

Recommendations Update to version 3.4.0.