CVE-2026-62241

Name of the Vulnerable Software and Affected Versions clawvet self-hosted API server (apps/api) versions prior to 0.7.5

Description The software contains a hard-coded fallback JWT (JSON Web Token) secret in auth.ts and provides it as the default in .env.example. An unauthenticated remote attacker can exploit this by first accessing the 'GET /api/v1/scans' endpoint to harvest userId values. Using the known secret, the attacker can forge a valid HS256 cg session cookie offline and subsequently call the 'GET /api/v1/auth/me' endpoint to retrieve a victim's email address, subscription plan, and secret apiKey.

Recommendations Update clawvet self-hosted API server (apps/api) to version 0.7.5 or later.