External risk intelligence

Clawvet API JWT Secret Vulnerability Allows Session Forgery

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-62241

The vulnerability affects a self-hosted API server that provides data access endpoints. APIs of this nature are commonly deployed as internet-facing services to facilitate communication for web or mobile applications, making them typically reachable from the internet.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in the clawvet self-hosted API server, specifically in versions prior to 0.7.5. This issue allows unauthenticated remote attackers to potentially access sensitive user information, including email addresses, subscription plans, and secret API keys, by exploiting a hard-coded secret used in session management.

A hard-coded secret allows unauthorized data access.
Affects self-hosted API servers, potentially exposing user data.
Confirm relevance and potential exposure to sensitive information.

Attack Path

How an attacker could exploit the issue

An attacker can begin by accessing the API server and obtaining a user's ID. With this ID, the attacker can then forge a session cookie offline using a known, hard-coded secret. This forged cookie allows the attacker to impersonate the victim and access their sensitive account information without needing any legitimate credentials or interaction.

No authentication is required.
Harvesting user IDs and forging cookies.
Access to sensitive user data.

Live Threat

Current exploitation, exposure, and threat context

A remote, unauthenticated attacker could obtain sensitive user information, including email addresses, subscription plans, and API keys, by exploiting a hard-coded JWT secret. This is possible when the self-hosted clawvet API server is accessible and has not been updated to a patched version.

User email, subscription, and API keys at risk.
Attacker forges session cookie offline.
Unauthorized access to sensitive user data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The `clawvet` self-hosted API server is likely managed by an application or platform team responsible for its deployment and maintenance. Initial steps should focus on understanding the scope of the affected API instances, confirming their accessibility, and identifying the specific business owner. Remediation planning should then be prioritized based on the criticality and exposure of these instances.

Application or Platform Teams
Verify API reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the clawvet API server?

Clawvet is a self-hosted API server component used to manage backend data and authentication services. It is designed to facilitate communication between client applications and stored user records. This vulnerability specifically affects the apps/api component, which developers deploy to support their own hosted web or mobile environments.

What is the weakness in CVE-2026-62241?

This vulnerability involves two weakness classes: Use of Hard-coded Cryptographic Key and Missing Authentication for Critical Function. The server includes a default, public secret key in its code that is intended to be changed but is often left as-is. Attackers can use this known key to mathematically sign their own forged session cookies, effectively bypassing the login process to impersonate any user on the system.

How does an attacker trigger this vulnerability?

An attacker triggers this by first querying the server's unauthenticated API endpoints to harvest valid user IDs. Once they have a target ID, they perform an offline calculation to create a fake session cookie using the hard-coded secret. Sending this forged cookie to the server then allows the attacker to retrieve private account details. Simply browsing the site or using the CLI-only version of the clawvet package does not trigger this flaw.

Do I need to worry if my clawvet instance is internal?

Halo Surface Signal identifies this as an external threat because these API servers are frequently deployed as internet-facing services to support web and mobile apps. If your instance is reachable from the public internet, the risk is significantly higher. Even if hosted internally, consider the potential impact if a compromised local device or user were to interact with the API.

Why should I update my clawvet installation?

Updating to version 0.7.5 or later is the necessary step to remove the hard-coded secret and secure your authentication flow. Because the existing secret is public knowledge, simply changing it in your configuration is the immediate priority for those unable to patch instantly. Work with your platform team to inventory all active API instances and verify that your deployment is no longer relying on the default credentials.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.