AstroBlocks: Admin session token forgery via hard-coded JWT secret (CVE-2026-64682)

A vulnerability in AstroBlocks (prior to version 3.4.0) allows for the forgery of administrative session tokens. The CMS utilizes a hard-coded fallback JWT secret that is publicly readable within the package source code. Due to a mismatched environment variable configuration, the application defaults to this insecure secret if the primary secret is not correctly set. An attacker who retrieves the fallback value can sign arbitrary JWTs with the role set to 'owner'.

Impact

An attacker successfully exploiting this vulnerability can obtain full administrative control over the CMS instance, including the ability to manage content, user accounts, media files, redirects, and system configurations.

Recommendation

• Patch AstroBlocks to version 3.4.0 or later immediately to remove the hard-coded fallback secret and correct the environment variable configuration.
• Audit administrative account activity for unauthorized modifications or newly created users post-deployment.
• Ensure that all production deployments of AstroBlocks have a strong, unique secret defined in the environment configuration to prevent fallback to default or insecure values.