External risk intelligence

Convoy Panel JWT Signature Verification Flaw Allows Authentication Bypass.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-33746

The product is a server management panel designed for hosting businesses. Such panels are typically deployed as web-based administrative interfaces accessible over the network to manage infrastructure, making them commonly reachable as web applications in their intended deployment environments.

Authentication Bypass

Convoypanel Convoy

before 4.5.1

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Convoy, a server management panel used by hosting businesses. The issue allows attackers to bypass authentication and impersonate any user by forging security tokens, potentially leading to unauthorized access and control of hosted environments. The primary concern is to confirm if Convoy is in use and ascertain the extent of potential exposure.

Attackers can forge login tokens.
Server access control could be compromised.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can gain unauthorized access to user accounts by forging authentication tokens. This is possible because the system fails to properly verify the digital signature of JWT tokens, allowing attackers to modify token contents, such as the user identifier, and still have them accepted. This vulnerability impacts the single sign-on authentication process and can lead to an attacker impersonating any user.

No authentication required to attack.
Tampering with JWT tokens triggers vulnerability.
Full account takeover is the risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to impersonate any user when the affected Convoy server management panel is configured for SSO. This is possible because the system does not properly verify the signature of security tokens, allowing forged tokens to be accepted as valid.

User authentication data.
Forged tokens bypass signature validation.
Unauthorized access to user accounts.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Convoy application, a KVM server management panel, is affected by a critical vulnerability that allows for forged JWT tokens, potentially enabling unauthorized access and impersonation. This requires immediate attention from teams responsible for application security and infrastructure management. The first practical step is to identify all deployed instances of Convoy, confirm their external reachability, and determine business criticality to prioritize remediation efforts.

Application and infrastructure teams own remediation.
Verify Convoy instances and external exposure.
Plan maintenance for critical systems.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Convoy software affected by CVE-2026-33746?

Convoy is a server management panel specifically built for hosting businesses to oversee KVM-based virtual machine environments. It provides a centralized web interface that allows administrators to manage infrastructure, server resources, and user access. Because it acts as a control plane for hosted services, it is typically deployed as a web application within a network, which is why it is often accessible to users or administrators over the internet.

Why does CVE-2026-33746 happen?

This vulnerability is an Improper Neutralization of Input During Web Page Generation and a failure to verify cryptographic signatures (CWE-287 and CWE-347). In Convoy, the system checks if a security token is expired or valid in time, but it forgets to confirm that the token was actually signed by a trusted source. Because the cryptographic signature is ignored, the software treats any token as authentic, even if an attacker has tampered with the identity data inside it.

What triggers this authentication bypass?

An attacker triggers this flaw by presenting a forged JSON Web Token (JWT) during the SSO authentication process. By modifying the user_uuid claim within a token, an attacker can impersonate any user on the platform. Crucially, the vulnerability is not triggered by legitimate users or normal system operations; it requires the deliberate submission of a custom, unsigned token, which the system erroneously accepts as valid.

Is my instance of Convoy at risk?

If you are running any version of Convoy prior to 4.5.1, you are at risk. Halo Surface Signal identifies this as a high-priority concern because Convoy is a web-based administrative panel. These panels are often exposed to the network to allow remote management, increasing the likelihood that an attacker can reach the vulnerable authentication endpoint. If your instance is reachable over the internet, the potential for unauthorized access is significant.

How should I respond to this vulnerability?

The most effective response is to update your Convoy deployment to version 4.5.1 or later, which includes the necessary security fixes. Start by inventorying all instances of the software within your infrastructure to identify which systems are running affected versions. Prioritize those instances that are internet-facing or manage critical business infrastructure for immediate patching to prevent potential account impersonation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.