Vendor
AstroBlocks versions prior to 3.4.0 contain a hard-coded fallback JWT secret, allowing unauthenticated attackers to forge administrative session tokens and gain full control over the CMS.