Hard-coded JWT signing secret enables token forgery and auth bypass (Crawlab)
A CVE with CVSS 9.8 and public threat-intel coverage appeared 2026-09-14 for a self-hosted platform frequently exposed on internal and internet-facing hosts.
Crawlab through 0.6.3 ships a hard-coded HMAC-SHA256 secret used to sign JWT session tokens, and it cannot be overridden via configuration or environment variables. An unauthenticated attacker who knows the key can forge valid admin tokens and take over the deployment. No vendor statement is quoted here.
Affected: Crawlab through 0.6.3
How to Test
Check your Crawlab version (<= 0.6.3 is affected); if the JWT secret cannot be set via config/env, you are running the vulnerable build. Watch for logins or API calls using tokens you did not issue.
How to Mitigate
Place the Crawlab interface behind authentication/VPN and off the public internet; upgrade to a fixed release that allows overriding the JWT secret as soon as one is published.