Executive Intelligence Brief

A critical vulnerability (CVE-2026-62241) with a CVSS score of 9.1 has been identified in the Clawvet self-hosted API server (apps/api) before version 0.7.5. This vulnerability allows a remote unauthenticated attacker to harvest user IDs, forge a valid session cookie, and obtain sensitive user information, including email addresses, subscription plans, and secret API keys. Although the vulnerability has not been actively exploited, its severity and potential impact necessitate immediate attention. Organizations using affected versions of Clawvet should upgrade to version 0.7.5 or later as soon as possible.

Threat Overview

The Clawvet self-hosted API server (apps/api) is a component of the Clawvet application, which is vulnerable to a critical security issue. The vulnerability arises from a hard-coded fallback JWT secret ('clawvet-dev-secret-change-me') in the auth.ts file, which is shipped as a default in .env.example. This secret is used to forge valid HS256 cg_session cookies. The published Clawvet npm package (CLI only) is not affected by this vulnerability.

The vulnerability has a significant impact due to the broad deployment footprint of Clawvet and the ease with which an attacker can exploit it. An attacker can use the API endpoint GET /api/v1/scans to harvest user IDs without authentication. With the hard-coded secret, an attacker can forge a valid session cookie and use it to obtain sensitive user information via the GET /api/v1/auth/me endpoint.

Technical Deep Dive

Vulnerability Classification

The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function) and CWE-321 (Use of Hard-coded Cryptographic Key). These weaknesses allow an attacker to bypass authentication and use a hard-coded secret to forge session cookies.

Root Cause Analysis

The root cause of the vulnerability is the hard-coding of a fallback JWT secret in the auth.ts file and its inclusion as a default in .env.example. This practice violates the principle of not hard-coding sensitive information, especially secrets used for authentication.

Attack Vector & Chain

The attack vector involves exploiting the API endpoint GET /api/v1/scans to harvest user IDs without authentication. An attacker then uses the hard-coded secret to forge a valid HS256 cg_session cookie offline. With this forged cookie, the attacker can call GET /api/v1/auth/me to obtain the victim's email address, subscription plan, and secret API key.

Exploitation Scenario Walkthrough

Scenario: Session Forgery via Hard-Coded JWT Secret

Reconnaissance: An attacker discovers the vulnerable Clawvet API server and identifies the version as being before 0.7.5.

Weaponization: The attacker prepares by noting the hard-coded secret 'clawvet-dev-secret-change-me' and understanding how to forge a valid HS256 cg_session cookie.

Delivery & Exploitation: The attacker sends a request to GET /api/v1/scans to harvest user IDs. Using a harvested user ID and the hard-coded secret, the attacker forges a valid cg_session cookie.

Post-Exploitation: The attacker uses the forged cookie to call GET /api/v1/auth/me, obtaining the victim's email address, subscription plan, and secret API key.

Impact Realization: The attacker achieves unauthorized access to sensitive user information, potentially leading to further exploitation or misuse of the obtained information.

Exploitation in the Wild

The vulnerability has not been actively exploited at the time of disclosure. However, given its severity and the ease of exploitation, there is a high likelihood that attackers will target this vulnerability in the future.

Impact Analysis

Direct Impact

The direct impact of this vulnerability allows an attacker to obtain sensitive user information, including email addresses, subscription plans, and secret API keys. This can lead to further exploitation, such as account takeovers, unauthorized API usage, or targeted phishing attacks.

Downstream & Cascading Effects

The downstream effects could include supply chain risks if the Clawvet API server is used in integrated systems, regulatory implications due to data exposure, and operational disruptions from potential account takeovers or unauthorized API usage.

Affected Products & Versions

The Clawvet self-hosted API server (apps/api) versions before 0.7.5 are affected. The published Clawvet npm package (CLI only) is not affected.

Detection & Threat Hunting

Indicators of Compromise

Indicators of compromise may include unusual API requests to /api/v1/scans or /api/v1/auth/me, especially from unknown or suspicious IP addresses. Monitoring for the creation of unusual session cookies or authentication attempts may also indicate exploitation.

Detection Rules & Signatures

Detection rules should focus on monitoring API endpoints for unusual patterns, especially those that involve harvesting user IDs or forging session cookies. Behavioral patterns indicating exploitation include unauthenticated requests to sensitive endpoints or an unusual number of session creation attempts.

Threat Hunting Queries

Threat hunting queries may involve searching for API logs that show repeated or suspicious requests to /api/v1/scans or /api/v1/auth/me, especially from sources that are not recognized or trusted.

Remediation & Hardening

Immediate Actions (0-24 hours)

Upgrade the Clawvet self-hosted API server to version 0.7.5 or later. Ensure that the JWT secret is securely generated and configured, not hard-coded in any form.

Short-Term Hardening (1-7 days)

Implement additional security controls such as network segmentation, WAF rules to detect and prevent suspicious API requests, and enhanced monitoring of API endpoints.

Strategic Recommendations

Long-term recommendations include implementing secure practices for secret management, enhancing authentication mechanisms for API endpoints, and conducting regular security audits to identify and address potential vulnerabilities.

Analyst Assessment

The vulnerability poses a significant risk due to its high severity and the potential for exploitation. Organizations should prioritize patching affected systems and enhancing security controls to prevent exploitation. The likelihood of exploitation is expected to increase as attackers become aware of the vulnerability.

Sources

  • National Vulnerability Database (NVD) - CVE-2026-62241