CVE-2026-90945

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

CVE-2026-90945

Crawlab versions through 0.6.3 contain a critical authentication bypass caused by a hard-coded HMAC-SHA256 secret used for JWT token signing. Because the secret cannot be overridden via configuration or environment variables, an unauthenticated network attacker can forge valid administrator token...

CVE-2026-90945 Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

CVE-2026-90945 Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

EUVD-2026-77712

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

CVE-2026-90945 Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

CVE-2026-90945: Use of Hard-coded Cryptographic Key

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

PT-2026-91291

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

CVE-2026-75103

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

CVE-2026-75103 Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

CVE-2026-75103

Crawlab 's password-change endpoint (core/controllers/user_v2.go) lacks authorization checks, so any authenticated user can reset any account's password. Combined with account enumeration via the user listing endpoint, attackers can compromise admin credentials to achieve full account takeover an...

CVE-2026-75103 Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

CVE-2026-75103 Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

EUVD-2026-60383

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

PT-2026-76798

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

CVE-2026-75103: Authorization Bypass Through User-Controlled Key

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...