CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-62241 — clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT...

·Source: NIST NVD

Updated:

Executive Summary

clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated attacker can harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known

Analysis

clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated attacker can harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known secret, and call GET /api/v1/auth/me to obtain the victim's email address, subscription plan, and secret apiKey. The published clawvet npm package (CLI only) is not affected. CVSS Score: 9.1. Published: 2026-07-17T02:18:11.740.

Indicators of Compromise (1)

CVE (1)
CVE-2026-62241
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 17, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Trump Revives Debunked Election Hacking Claims

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/trump-set-to-revive-debunked-election-hacking-claims-image_small-2-a-32249.jpg" align=right hspace=4><b>Courts, Audits and Federal Agencies Found No Evidence 2020 Votes Were Altered</b><br>U.S. President Donald Trump used a primetime address Thursday night to allege that China carried out a sweeping compromise of American voter da

Bank Info Security
CRITICALVulnerability

NVD CRITICAL: CVE-2026-14956 — The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in al...

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-field whitelist. This makes it possible for unauthenticated attackers to register a new administrator acco

CVE-2026-14956
NIST NVD
MEDIUMVulnerability

HSBC joins digital gilt pilot as investor depository

The London Stock Exchange Group and HSBC have come together to support HM Treasury's Digital Gilt Instrument (Digit) pilot issuance

Finextra