Executive brief
Convoy, a management panel used by hosting businesses to run virtual servers, contains a critical security flaw in how it handles user logins. Because the system fails to verify the digital signatures of security tokens, an attacker can create a fake identity and log in as any user, including administrators. This could lead to a total takeover of the hosting platform, unauthorized access to customer data, and disruption of hosted services.
Technical details
A vulnerability exists in the JWTService::decode() method of Convoy due to improper verification of cryptographic signatures (CWE-347). While the application uses the lcobucci/jwt library, it only implements time-based validation (StrictValidAt) and omits the SignedWith constraint. A remote, unauthenticated attacker can exploit this by crafting a JWT with a forged payload—specifically modifying the user_uuid claim—to bypass the SSO authentication flow in LoginController::authorizeToken. This allows for complete authentication bypass and administrative access. The issue is resolved in version 4.5.1 by adding the missing signature validation step.
Affected products
- ConvoyPanel Convoy >= 3.9.0-beta, < 4.5.1
Timeline
- 2026-03-24: patched: Version 4.5.1 released
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE-2026-33746 published to NVD