{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aastroblocksastroblocks/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:astroblocks:astroblocks:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-64682"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AstroBlocks (\u003c 3.4.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["AstroBlocks"],"content_html":"\u003cp\u003eA vulnerability in AstroBlocks (prior to version 3.4.0) allows for the forgery of administrative session tokens. The CMS utilizes a hard-coded fallback JWT secret that is publicly readable within the package source code. Due to a mismatched environment variable configuration, the application defaults to this insecure secret if the primary secret is not correctly set. An attacker who retrieves the fallback value can sign arbitrary JWTs with the role set to 'owner'.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker successfully exploiting this vulnerability can obtain full administrative control over the CMS instance, including the ability to manage content, user accounts, media files, redirects, and system configurations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch AstroBlocks to version 3.4.0 or later immediately to remove the hard-coded fallback secret and correct the environment variable configuration.\u003c/li\u003e\n\u003cli\u003eAudit administrative account activity for unauthorized modifications or newly created users post-deployment.\u003c/li\u003e\n\u003cli\u003eEnsure that all production deployments of AstroBlocks have a strong, unique secret defined in the environment configuration to prevent fallback to default or insecure values.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T13:58:43Z","date_published":"2026-11-11T13:58:43Z","id":"https://feed.craftedsignal.io/briefs/2026-11-astroblocks-session-forgery-cve-2026-64682/","summary":"AstroBlocks versions prior to 3.4.0 contain a hard-coded fallback JWT secret, allowing unauthenticated attackers to forge administrative session tokens and gain full control over the CMS.","title":"AstroBlocks: Admin session token forgery via hard-coded JWT secret (CVE-2026-64682)","url":"https://feed.craftedsignal.io/briefs/2026-11-astroblocks-session-forgery-cve-2026-64682/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:astroblocks:astroblocks:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}