CVE-2026-62241: Clawvet API Auth Bypass Vulnerability

CVE-2026-62241 Overview

CVE-2026-62241 is a hard-coded credentials vulnerability [CWE-306] in the clawvet self-hosted API server (apps/api) affecting versions prior to 0.7.5. The auth.ts module contains a fallback JWT secret (clawvet-dev-secret-change-me) that is also shipped as the default in .env.example. An unauthenticated remote attacker can query GET /api/v1/scans to harvest userId values, then forge a valid HS256 cg_session cookie offline. The forged cookie enables calls to GET /api/v1/auth/me, exposing victim email addresses, subscription plans, and secret API keys. The published clawvet npm package (CLI only) is not affected.

Critical Impact

Remote unauthenticated attackers can forge session cookies to impersonate any user and exfiltrate stored API keys and account data.

Affected Products

• clawvet self-hosted API server (apps/api) versions prior to 0.7.5
• Deployments using the default .env.example JWT secret
• Any instance exposing /api/v1/scans without additional authentication

Discovery Timeline

• 2026-07-17 - CVE-2026-62241 published to NVD
• 2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-62241

Vulnerability Analysis

The vulnerability combines two design flaws that individually are recoverable but together enable full account impersonation. First, the auth.ts module in the clawvet API server uses a hard-coded fallback JWT signing secret when no environment variable is supplied. Second, the same literal secret is committed to .env.example, meaning many production deployments retain it unchanged.

Session cookies (cg_session) are signed using HS256 with this predictable secret. Because HS256 is symmetric, any party knowing the secret can mint valid tokens for arbitrary claims. The API additionally exposes GET /api/v1/scans without authentication, leaking userId values that would otherwise be the only unknown claim needed to forge a valid session.

The result is a full offline session forgery primitive requiring no interaction with the victim.

Root Cause

The root cause is hard-coded credentials [CWE-306] combined with missing authentication on a data endpoint. The fallback secret clawvet-dev-secret-change-me is embedded directly in source code and duplicated in the sample environment file. Deployments that do not explicitly override JWT_SECRET inherit a globally known signing key.

Attack Vector

An attacker performs the following sequence against an exposed clawvet API server:

1. Send an unauthenticated GET /api/v1/scans request and parse userId values from the response.
2. Construct an HS256 JWT with the harvested userId, signing it with clawvet-dev-secret-change-me.
3. Set the token as the cg_session cookie and send GET /api/v1/auth/me.
4. Read back the victim's email, subscription plan, and secret apiKey.

The harvested apiKey can then be reused against any downstream service the victim has integrated. The vulnerability is described in the GitHub Security Advisory and the VulnCheck Advisory on Clawvet.

Detection Methods for CVE-2026-62241

Indicators of Compromise

• Unauthenticated GET /api/v1/scans requests from unfamiliar source addresses, especially in bursts enumerating scan records.
• GET /api/v1/auth/me requests presenting a cg_session cookie shortly after /api/v1/scans reconnaissance from the same IP.
• Successful auth/me responses for users whose recent activity does not correlate with an interactive login event.
• JWT tokens whose signature verifies against the literal string clawvet-dev-secret-change-me.

Detection Strategies

• Inspect the running JWT_SECRET environment value and alert if it equals the shipped default.
• Decode server-side session cookies during request handling and log any token signed with the known-bad secret.
• Correlate access patterns where a single client transitions from unauthenticated /scans reads to authenticated /auth/me calls for multiple distinct user IDs.

Monitoring Recommendations

• Forward API access logs to a centralized analytics platform and build rules for anomalous userId enumeration.
• Track API key usage patterns for sudden geographic or user-agent shifts consistent with credential replay.
• Monitor for outbound calls made with API keys issued to accounts that have not authenticated interactively in the same window.

How to Mitigate CVE-2026-62241

Immediate Actions Required

• Upgrade the self-hosted clawvet API server to version 0.7.5 or later.
• Rotate JWT_SECRET to a cryptographically random value of at least 32 bytes and restart the API server.
• Invalidate all outstanding cg_session cookies and force re-authentication for every user.
• Rotate every user-facing apiKey since prior values may have been exfiltrated.

Patch Information

The fix is available in clawvet apps/api version 0.7.5. The upstream advisory documenting the fix and the removal of the fallback secret is published in the GitHub Security Advisory. Operators should review release notes for any additional configuration changes and confirm that .env.example no longer contains a usable secret.

Workarounds

• Set JWT_SECRET to a unique, high-entropy value in the runtime environment before restarting the API server.
• Require authentication on GET /api/v1/scans via a reverse proxy or WAF rule until the upgrade is applied.
• Restrict network exposure of apps/api to trusted networks or an authenticated ingress until patched.

# Configuration example
# Generate a strong secret and export it before starting the API server
export JWT_SECRET="$(openssl rand -base64 48)"

# Verify the running process is not using the shipped default
grep -R "clawvet-dev-secret-change-me" ./ && echo "Default secret still present - do not start"