CyberRota Analysis
AI-GeneratedThe clawvet self-hosted API server prior to version 0.7.5 contains a critical vulnerability due to a hard-coded JWT secret, allowing remote unauthenticated attackers to access user IDs and forge valid session cookies. This exploitation can lead to unauthorized retrieval of sensitive user information, including email addresses and API keys. Organizations using this API server should prioritize immediate updates to version 0.7.5 or later to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated attacker can harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known secret, and call GET /api/v1/auth/me to obtain the victim's email address, subscription plan, and secret apiKey. The published clawvet npm package (CLI only) is not affected.