CVE-2026-64682

The AstroBlocks block-first CMS (prior to version 3.4.0 ) is vulnerable to forged admin session tokens. The root cause is a hard-coded fallback JWT secret combined with a mismatched environment variable name , allowing an attacker to use a publicly readable fallback value from the published packa...

CVE-2026-64682 AstroBlocks: Admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name

AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value readable in the published package can forge a valid...