CVE-2026-125370

Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWTSECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions...

CVE-2026-125370 Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret

Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWTSECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions...

PT-2026-141193

Name of the Vulnerable Software and Affected Versions Kubero versions 3.0.0 through 3.1.1 Description An authentication bypass exists that allows unauthenticated remote attackers to forge administrative JSON Web Tokens JWTs when the JWT SECRET variable is unset. This occurs because the system use...