VULNERABILITY INTELLIGENCE

CVE-2026-56265

CVSS score9.8 CRITICAL
EPSS probability2.64%
CISA KEVNot currently listed
Published2026-06-21
Last modified2026-06-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.

Weakness classification

  • disclosure@vulncheck.com: CWE-798

Primary references