---
id: CVE-2026-62241
title: >-
  clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback
  JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the
  default in .env.example
summary: >-
  clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback
  JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the
  default in .env.example. Because GET /api/v1/scans returns scan records
  containing us…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-306
  - CWE-321
vendor: mohibshaikh
product: clawvet
affected:
  - clawvet < 0.7.5
patched:
  - clawvet 0.7.5
published: '2026-07-17'
updated: '2026-08-14'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-62241'
references:
  - url: >-
      https://github.com/MohibShaikh/clawvet/security/advisories/GHSA-9mww-p953-jfc9
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/clawvet-hard-coded-jwt-secret-session-forgery
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/MohibShaikh/clawvet/security/advisories/GHSA-9mww-p953-jfc9
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.0067
epssPercentile: 0.49793
ingestedAt: '2026-08-15T14:26:51.871Z'
---

## Overview

clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated attacker can harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known secret, and call GET /api/v1/auth/me to obtain the victim's email address, subscription plan, and secret apiKey. The published clawvet npm package (CLI only) is not affected.

## Affected

- `clawvet < 0.7.5`

## Remediation

Upgrade past the affected range:

- `clawvet 0.7.5`