CVE-2026-33746

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33746", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-23T18:30:14.124Z", "datePublished": "2026-04-02T15:06:05.832Z", "dateUpdated": "2026-04-02T18:50:14.459Z"}, "containers": {"cna": {"title": "Convoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary Users", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/ConvoyPanel/panel/security/advisories/GHSA-92pg-3w49-4w5x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ConvoyPanel/panel/security/advisories/GHSA-92pg-3w49-4w5x"}, {"name": "https://github.com/ConvoyPanel/panel/releases/tag/v4.5.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/ConvoyPanel/panel/releases/tag/v4.5.1"}], "affected": [{"vendor": "ConvoyPanel", "product": "panel", "versions": [{"version": ">= 3.9.0-beta, < 4.5.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-02T15:06:05.832Z"}, "descriptions": [{"lang": "en", "value": "Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signer via lcobucci/jwt, it only validated time-based claims (exp, nbf, iat) using the StrictValidAt constraint. The SignedWith constraint was not included in the validation step. This means an attacker could forge or tamper with JWT token payloads \u2014 such as modifying the user_uuid claim \u2014 and the token would be accepted as valid, as long as the time-based claims were satisfied. This directly impacts the SSO authentication flow (LoginController::authorizeToken), allowing an attacker to authenticate as any user by crafting a token with an arbitrary user_uuid. This issue has been patched in version 4.5.1."}], "source": {"advisory": "GHSA-92pg-3w49-4w5x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T18:49:33.555330Z", "id": "CVE-2026-33746", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T18:50:14.459Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33746", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-02T18:49:33.555330Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T18:50:08.167Z"}}], "cna": {"title": "Convoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary Users", "source": {"advisory": "GHSA-92pg-3w49-4w5x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ConvoyPanel", "product": "panel", "versions": [{"status": "affected", "version": ">= 3.9.0-beta, < 4.5.1"}]}], "references": [{"url": "https://github.com/ConvoyPanel/panel/security/advisories/GHSA-92pg-3w49-4w5x", "name": "https://github.com/ConvoyPanel/panel/security/advisories/GHSA-92pg-3w49-4w5x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ConvoyPanel/panel/releases/tag/v4.5.1", "name": "https://github.com/ConvoyPanel/panel/releases/tag/v4.5.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signer via lcobucci/jwt, it only validated time-based claims (exp, nbf, iat) using the StrictValidAt constraint. The SignedWith constraint was not included in the validation step. This means an attacker could forge or tamper with JWT token payloads \u2014 such as modifying the user_uuid claim \u2014 and the token would be accepted as valid, as long as the time-based claims were satisfied. This directly impacts the SSO authentication flow (LoginController::authorizeToken), allowing an attacker to authenticate as any user by crafting a token with an arbitrary user_uuid. This issue has been patched in version 4.5.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-02T15:06:05.832Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33746", "state": "PUBLISHED", "dateUpdated": "2026-04-02T18:50:14.459Z", "dateReserved": "2026-03-23T18:30:14.124Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-02T15:06:05.832Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "panel", "vendor": "ConvoyPanel", "versions": [{"status": "affected", "version": ">= 3.9.0-beta, < 4.5.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:convoypanel:convoy:*:*:*:*:*:*:*:*", "matchCriteriaId": "2833A04F-7442-4174-A9EA-C4C44F1F882A", "versionEndExcluding": "4.5.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signer via lcobucci/jwt, it only validated time-based claims (exp, nbf, iat) using the StrictValidAt constraint. The SignedWith constraint was not included in the validation step. This means an attacker could forge or tamper with JWT token payloads \u2014 such as modifying the user_uuid claim \u2014 and the token would be accepted as valid, as long as the time-based claims were satisfied. This directly impacts the SSO authentication flow (LoginController::authorizeToken), allowing an attacker to authenticate as any user by crafting a token with an arbitrary user_uuid. This issue has been patched in version 4.5.1."}, {"lang": "es", "value": "Convoy es un panel de gesti\u00f3n de servidores KVM para empresas de alojamiento. Desde la versi\u00f3n 3.9.0-beta hasta antes de la versi\u00f3n 4.5.1, el m\u00e9todo JWTService::decode() no verificaba la firma criptogr\u00e1fica de los tokens JWT. Aunque el m\u00e9todo configuraba un firmante sim\u00e9trico HMAC-SHA256 a trav\u00e9s de lcobucci/jwt, solo validaba las reclamaciones basadas en el tiempo (exp, nbf, iat) utilizando la restricci\u00f3n StrictValidAt. La restricci\u00f3n SignedWith no estaba incluida en el paso de validaci\u00f3n. Esto significa que un atacante podr\u00eda falsificar o manipular las cargas \u00fatiles de los tokens JWT - como modificar la reclamaci\u00f3n user_uuid - y el token ser\u00eda aceptado como v\u00e1lido, siempre que las reclamaciones basadas en el tiempo se cumplieran. Esto impacta directamente el flujo de autenticaci\u00f3n SSO (LoginController::authorizeToken), permitiendo a un atacante autenticarse como cualquier usuario creando un token con un user_uuid arbitrario. Este problema ha sido parcheado en la versi\u00f3n 4.5.1."}], "id": "CVE-2026-33746", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33746", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-02T18:49:33.555330Z", "version": "2.0.3"}}]}, "published": "2026-04-02T16:16:22.803", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/ConvoyPanel/panel/releases/tag/v4.5.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/ConvoyPanel/panel/security/advisories/GHSA-92pg-3w49-4w5x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-347"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.9.0-beta,4.5.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "panel", "source": "cna", "vendor": "ConvoyPanel"}, "product": "panel", "vendor": "convoypanel"}], "analysis": {"en": {"generated_at": "2026-04-02T16:20:51.497160+00:00", "value": {"mitigation_remediation": ["Upgrade ConvoyPanel to version 4.5.1 or later, which restores JWT signature verification.", "Confirm that the updated login flow is active and that only signed tokens are accepted.", "Validate that user_uuid values cannot be arbitrarily set by testing with a fabricated token and reviewing logs for rejected attempts."], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "ConvoyPanel:panel, a KVM server management panel used by hosting vendors, is affected in releases from version 3.9.0\u2011beta up to, but excluding, 4.5.1. The fix was introduced in 4.5.1, which implementation now verifies JWT signatures with the SignedWith constraint.", "description_and_impact": "The vulnerability resides in the JWTService::decode() method where the cryptographic signature of JWT tokens was never validated. This omission allowed an attacker to forge or modify the token payload, such as changing the user_uuid claim, while still passing time\u2011based checks. As a result, authentication as any user was possible through the SSO flow without a valid login. The weakness is a clear abuse of authentication logic, letting an attacker gain unauthorized access to the platform.", "risk_and_exploitability": "With a CVSS score of 9.8 the flaw is considered critical. No EPSS data is publicly available, but the lack of signature validation makes exploitation trivial for anyone who can craft a token. It is not listed in the CISA KEV catalog at the time of writing, yet organizations using the vulnerable ConvoyPanel version should treat it as a top\u2011priority risk. The most likely attack vector is the web interface's SSO authentication endpoint, where a crafted JWT can be submitted to obtain full user privileges."}}}}, "created": "2026-04-02T20:11:30.352534+00:00", "updated": "2026-04-02T20:20:11.930357+00:00", "vendors": ["convoypanel", "convoypanel$PRODUCT$panel"]}