CVE-2026-90945

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

EUVD-2026-77712

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

CVE-2026-90945 Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

CVE-2026-90945 Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

CVE-2026-90945 Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

CVE-2026-90945

Crawlab versions through 0.6.3 contain a critical authentication bypass caused by a hard-coded HMAC-SHA256 secret used for JWT token signing. Because the secret cannot be overridden via configuration or environment variables, an unauthenticated network attacker can forge valid administrator token...

PT-2026-91291

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

CVE-2026-90945: Use of Hard-coded Cryptographic Key

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

crawlab-sdk (>=0.0.5, <=0.2.0), htmlparsingbs4based (>=0.0.1, <=1.1.0) +3 more potentially affected by CVE-2026-84366 via scrapy (1.8.0)

scrapy PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on scrapy and may be impacted: - crawlab-sdk =0.0.5, =0.0.1, =0.0.1, =0.0.4 - scrapydartx 1.3.2 - stand 0.1.11 Source cves: CVE-2026-84366 Source advisory: OSV:PYSEC-2026-3918...

CVE-2026-75103

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

CVE-2026-75103 Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

CVE-2026-75103

Crawlab 's password-change endpoint (core/controllers/user_v2.go) lacks authorization checks, so any authenticated user can reset any account's password. Combined with account enumeration via the user listing endpoint, attackers can compromise admin credentials to achieve full account takeover an...

EUVD-2026-60383

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

CVE-2026-75103 Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

CVE-2026-75103 Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

PT-2026-76798

Name of the Vulnerable Software and Affected Versions Crawlab affected versions not specified Description An issue exists where the software fails to verify user ownership or administrative roles on the password-change endpoint. This allows any authenticated user to reset the password of any...

CVE-2026-75103: Authorization Bypass Through User-Controlled Key

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

Crawlab - Arbitrary File Read Detection

Crawlab is vulnerable to arbitrary file read. !/usr/bin/env python3 -- coding: utf-8 -- """Crawlab is vulnerable to arbitrary file read.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Crawlab - Arbitrary...

crawlab-sdk (>=0.0.5, <=0.2.0), htmlparsingbs4based (>=0.0.1, <=1.1.0) +3 more potentially affected by CVE-2024-1968 via scrapy (1.8.0)

scrapy PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on scrapy and may be impacted: - crawlab-sdk =0.0.5, =0.0.1, =0.0.1, =0.0.4 - scrapydartx 1.3.2 - stand 0.1.11 Source cves: CVE-2024-1968 Source advisory: OSV:PYSEC-2024-258...

crawlab-sdk (>=0.0.5, <=0.2.0), htmlparsingbs4based (>=0.0.1, <=1.1.0) +3 more potentially affected by CVE-2022-0577 via scrapy (1.8.0)

scrapy PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on scrapy and may be impacted: - crawlab-sdk =0.0.5, =0.0.1, =0.0.1, =0.0.4 - scrapydartx 1.3.2 - stand 0.1.11 Source cves: CVE-2022-0577 Source advisory: OSV:PYSEC-2022-159...