HIGHCVSS v3.1 7.4Vulnerability
CVE-2026-125758
Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTH_SECRET. Attackers can enumerate registered e-mails via /api/_auth/signin, forge HS256 JWTs redeemed by /api/_auth/continue, impersonate users, export analytics data, and transfer app ownership.
Properties
- First seen
- 2026-11-10T18:31:41+00:00
- Cvss score
- 7.4
- Last seen
- 2026-11-10T18:31:41+00:00
- Euvd assigner
- VulnCheck
- Retrieved at
- 2026-11-10T23:34:23+00:00
- Src batch id
- euvd-20261110T193402Z-263c5d
- Source url
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-121241
- Score
- 7.4
- Euvd base score version
- 4.0
- Fetched at
- 2026-11-10T19:34:21+00:00
- Euvd vendor
- aptabase
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- First seen by Signal
- 2026-11-10T19:28:55+00:00
- Euvd base score
- 9.1
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Content hash
- 5230015e921075128546c89c07cb0f79ae87bb22aa203e5a68cd900554611355
- Published at
- 2026-11-10T16:17:23.267
- Euvd updated
- 2026-11-10T18:31:41+00:00
- Last modified
- 2026-11-10T16:17:23.267
- Euvd epss pct
- 0
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph