CVE-2026-125758
7.4 HIGHpublic exploit availablePublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTH_SECRET. Attackers can enumerate registered e-mails via /api/_auth/signin, forge HS256 JWTs redeemed by /api/_auth/continue, impersonate users, export analytics data, and transfer app ownership.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-1188
Public exploit & PoC references
All references
- https://github.com/aptabase/aptabase/commit/61d4c01298a706d575265461ac07bb956ca7b8d2
- https://github.com/aptabase/aptabase/pull/204
- https://github.com/aptabase/aptabase/security/advisories/GHSA-gc76-cqm4-vqcf
- https://github.com/aptabase/self-hosting/commit/b79a472419ff17e485d0bd5b4adf1b1ef2b9953c
- https://www.vulncheck.com/advisories/aptabase-before-commit-61d4c01-authentication-bypass-via-known-example-auth-secret
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-100260
- CRITICALCVE-2026-100291
- HIGHCVE-2026-102676PoC
- UNSCOREDCVE-2026-103091PoC
- CRITICALCVE-2026-103956PoC
- HIGHCVE-2026-104077
- HIGHCVE-2026-104078
- HIGHCVE-2026-105744PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.