EUVD-2026-118502

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, four authentication helpers accepted session tokens signed with CBSECRET, including known, weak, or shipped-default values. The vulnerable surface is...

CVE-2026-85295

Prior to version 5.2.3 , Chartbrew is vulnerable to a full account takeover due to a session JWT fallback flaw. The application's authentication helpers (specifically in verifyToken.js, verifyUser.js, getUserFromToken.js, and socketManager.js) accept tokens signed with CB_SECRET , including known...