Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated attacker can harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known secret, and call GET /api/v1/auth/me to obtain the victim's email address, subscription plan, and secret apiKey. The published clawvet npm package (CLI only) is not affected.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 CVE-2026-62241 — CVSS 9.1/10 █████████░ clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/nMiBrkZHTq
Post summary
The tweet announces CVE‑2026‑62241 as a critical flaw in clawvet’s API server, describes a hard‑coded fallback JWT secret in versions before 0.7.5, and urges users to apply the patch immediately.
CVE-2026-62241 Unauthenticated JWT Secret Exposure in Clawvet Self-Hosted API Server Before 0.7.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-62241
Post summary
CVE-2026-62241 details an unauthenticated JWT secret exposure in Clawvet's self-hosted API server prior to version 0.7.5. No PoC, exploit, or patch information accompanies the disclosure.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mohibshaikh | clawvet | - | node.js | - |