CVE-2026-125758 Aptabase before commit 61d4c01 Authentication Bypass via Known Example AUTH_SECRET
CriticalCVSS 9.1
- Published
- Updated
- Exploit status
- No public exploit known
Description
Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTH_SECRET. Attackers can enumerate registered e-mails via /api/_auth/signin, forge HS256 JWTs redeemed by /api/_auth/continue, impersonate users, export analytics data, and transfer app ownership.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| aptabase/aptabase | < 61d4c01298a706d575265461ac07bb956ca7b8d2 | 61d4c01298a706d575265461ac07bb956ca7b8d2 |
References
- GitHub Security Advisory (GHSA-gc76-cqm4-vqcf) vendor-advisory
- github.com patch
- github.com issue-tracking patch
- github.com patch
- VulnCheck Advisory: Aptabase before commit 61d4c01 Authentication Bypass via Known Example AUTH_SECRET third-party-advisory