Executive brief
CronMaster, a management tool for scheduling automated tasks (cronjobs), contains a security flaw that allows unauthorized users to bypass login screens. By providing a fake session cookie that causes the system's internal validation to crash, an attacker can gain full access to the management interface. This allows them to view private logs, modify scheduled tasks, and execute administrative commands, potentially leading to full system compromise or data theft.
Technical details
An authentication bypass exists in the `proxy.ts` middleware of CronMaster due to a 'fail-open' error handling pattern. When a request includes a session cookie, the middleware attempts to validate it via an internal fetch request to `/api/auth/check-session`. If this internal request fails or throws an exception (which can be induced by an attacker under certain conditions), the `catch` block logs the error but allows the request to proceed using `NextResponse.next()` instead of denying access. This allows unauthenticated attackers to reach protected routes and execute privileged Next.js Server Actions. The issue is resolved in version 2.2.0 by ensuring the middleware denies access if session validation fails.
Affected products
- fccview cronmaster < 2.2.0
Timeline
- 2026-03-25: patched: Version 2.2.0 released
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-01: disclosed: CVE-2026-34072 published