CVE-2026-64682

{
  "etk_id": "ETK-2026-4140",
  "cve_id": "CVE-2026-64682",
  "display_id": "CVE-2026-64682",
  "ghsa_id": "GHSA-mfcg-m7j5-7v72",
  "euvd_id": "EUVD-2026-123134",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Hard-coded JWT secret authentication bypass in astro-blocks",
  "summary": "astro-blocks versions earlier than 3.4.0 can accept administrator session tokens signed with an embedded fallback secret. An attacker able to obtain that publicly distributed secret can impersonate an owner and administer CMS content, users, media, redirects, and settings.",
  "mitigation": "Upgrade astro-blocks to version 3.4.0 or later. Treat existing administrator sessions and credentials as potentially exposed and rotate or invalidate them after upgrading.",
  "vendor": "NauelG",
  "product": "astro-blocks",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 3.4.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.4.0"
      ],
      "package_name": "@astroblocks/astro-blocks",
      "purl": "pkg:npm/@astroblocks/astro-blocks"
    }
  ],
  "cwes": [
    321
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 17.067300566666667,
  "t0_at": "2026-11-11T04:04:09.388000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-11T04:56:04.198405+00:00",
      "days": 0.036051046354166665,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T04:04:09.388000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-11T04:04:09.388000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T04:04:09.388000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64682"
    }
  }
}