{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/aptabase--commit-61d4c01/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:aptabase:aptabase:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-125758"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Aptabase (\u003c commit 61d4c01)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Aptabase"],"content_html":"\u003cp\u003eAptabase versions before commit 61d4c01 are vulnerable to an authentication bypass. The platform uses a publicly known example value for the \u003ccode\u003eAUTH_SECRET\u003c/code\u003e environment variable, enabling unauthenticated attackers to bypass authentication controls. Successful exploitation allows an attacker to enumerate registered emails, forge HS256 JWTs, impersonate users, export analytics data, and transfer ownership of applications.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthorized access to user accounts and administrative functionality. Impact includes full account takeover, unauthorized access to private analytics data, and potential loss of control over hosted applications.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Aptabase to commit 61d4c01 or later immediately.\u003c/li\u003e\n\u003cli\u003eRotate the \u003ccode\u003eAUTH_SECRET\u003c/code\u003e environment variable to a strong, unique, and non-default value if it was previously set to an example or default value.\u003c/li\u003e\n\u003cli\u003eReview application access logs for unusual account sign-in activity or ownership transfers associated with suspicious source IPs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T18:27:59Z","date_published":"2026-11-10T18:27:59Z","id":"https://feed.craftedsignal.io/briefs/2026-11-aptabase-auth-bypass/","summary":"Aptabase versions prior to commit 61d4c01 contain an authentication bypass vulnerability allowing unauthenticated attackers to forge sign-in links and impersonate users via a publicly known AUTH_SECRET.","title":"Aptabase: Authentication bypass via default secret (CVE-2026-125758)","url":"https://feed.craftedsignal.io/briefs/2026-11-aptabase-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Aptabase (\u003c Commit 61d4c01)","version":"https://jsonfeed.org/version/1.1"}