Skip to content
Threat Feed
Subscribe

Product

Crawlab (<= 0.6.3)

1 brief RSS
critical advisory

Hard-coded JWT Secret in Crawlab Vulnerability

Crawlab versions 0.6.3 and earlier utilize a hard-coded HMAC-SHA256 secret for JWT signing, enabling unauthenticated attackers to forge administrative tokens and achieve remote code execution.

Crawlab web-application authentication-bypass remote-code-execution
2t 1c