CVE-2026-62241
A critical flaw in clawvet's self‑hosted API server allows anyone on the network to read sensitive user data. The server ships with a hard‑coded secret that lets attackers forge authentication tokens and pull private information such as email addresses and API keys. The vulnerability exists in versions before 0.7.5.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
clawvet self‑hosted API server (apps/api) versions earlier than 0.7.5
Real-world impact
An attacker who can reach the API can discover user identifiers, create valid session cookies, and then retrieve each victim’s email address, subscription plan, and secret API key, effectively compromising all user accounts.
Why this severity
The CVSS score of 9.3 reflects that the flaw is easily exploitable from the network, requires no user interaction, and gives an attacker full confidentiality and integrity compromise of sensitive data. The impact is high because it exposes private user information and credentials.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources