Aptabase: Authentication bypass via default secret (CVE-2026-125758)

Aptabase versions before commit 61d4c01 are vulnerable to an authentication bypass. The platform uses a publicly known example value for the AUTH_SECRET environment variable, enabling unauthenticated attackers to bypass authentication controls. Successful exploitation allows an attacker to enumerate registered emails, forge HS256 JWTs, impersonate users, export analytics data, and transfer ownership of applications.

Impact

The vulnerability allows unauthorized access to user accounts and administrative functionality. Impact includes full account takeover, unauthorized access to private analytics data, and potential loss of control over hosted applications.

Recommendation

• Update Aptabase to commit 61d4c01 or later immediately.
• Rotate the AUTH_SECRET environment variable to a strong, unique, and non-default value if it was previously set to an example or default value.
• Review application access logs for unusual account sign-in activity or ownership transfers associated with suspicious source IPs.