Executive brief
Clawvet, a self-hosted API server, contains a security flaw where it uses a publicly known, hard-coded password to secure user sessions. An attacker can exploit this by first gathering user IDs from a public list and then creating fake login credentials to impersonate any user. This allows unauthorized access to sensitive information, including user email addresses, subscription details, and secret API keys, potentially leading to a full account takeover.
Technical details
The vulnerability arises from two primary issues: the use of a hard-coded fallback JWT secret ('clawvet-dev-secret-change-me') in 'auth.ts' and the lack of authentication on the 'GET /api/v1/scans' endpoint. An unauthenticated remote attacker can first query the scans endpoint to harvest victim UUIDs (userIds). Using the publicly known secret, the attacker can then forge a valid HS256 'cg_session' cookie offline. By presenting this forged cookie to the 'GET /api/v1/auth/me' endpoint, the attacker can impersonate the victim and retrieve sensitive account details, including the user's email address and secret apiKey. The issue is fixed in version 0.7.5 by requiring a unique JWT_SECRET and adding authentication to the scans endpoint.
Affected products
- MohibShaikh clawvet self-hosted API server before 0.7.5
Timeline
- 2026-07-13: advisory: GitHub Security Advisory published
- 2026-07-16: advisory: NVD and VulnCheck advisories published
- 2026-07-17: disclosed