CVE-2026-45223

Crabbox prior to 0.9.0 contains an authentication bypass in the coordinator’s user-token verification path. The verifyUserToken() function fails to reject payloads with an admin: true claim, enabling an attacker with access to a non-admin token to craft a user-token payload, sign it with HMAC-SHA...