Cpe:2.3:a:aptabase:aptabase:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aaptabaseaptabase/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 18:27:59 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAptabase: Authentication bypass via default secret (CVE-2026-125758)https://feed.craftedsignal.io/briefs/2026-11-aptabase-auth-bypass/Tue, 10 Nov 2026 18:27:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-aptabase-auth-bypass/Aptabase versions prior to commit 61d4c01 contain an authentication bypass vulnerability allowing unauthenticated attackers to forge sign-in links and impersonate users via a publicly known AUTH_SECRET.Aptabase versions before commit 61d4c01 are vulnerable to an authentication bypass. The platform uses a publicly known example value for the AUTH_SECRET environment variable, enabling unauthenticated attackers to bypass authentication controls. Successful exploitation allows an attacker to enumerate registered emails, forge HS256 JWTs, impersonate users, export analytics data, and transfer ownership of applications.

Impact

The vulnerability allows unauthorized access to user accounts and administrative functionality. Impact includes full account takeover, unauthorized access to private analytics data, and potential loss of control over hosted applications.

Recommendation

  • Update Aptabase to commit 61d4c01 or later immediately.
  • Rotate the AUTH_SECRET environment variable to a strong, unique, and non-default value if it was previously set to an example or default value.
  • Review application access logs for unusual account sign-in activity or ownership transfers associated with suspicious source IPs.
]]>highadvisory