{"id":"CVE-2026-64682","published":"2026-11-11T05:19:52.120","lastModified":"2026-11-11T05:19:52.120","description":"AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in the published package) can forge a valid session token with role: \"owner\" and obtain full administrative control of the CMS — creating/deleting content, users, media, redirects, and configuration. This issue has been patched in version 3.4.0.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-321","CWE-798"],"vendors":[],"products":[],"references":[{"url":"https://github.com/NauelG/astro-blocks/commit/fd83bf0b37a756363f718e134c16e448da09a74d","tags":[]},{"url":"https://github.com/NauelG/astro-blocks/pull/51","tags":[]},{"url":"https://github.com/NauelG/astro-blocks/releases/tag/v3.4.0","tags":[]},{"url":"https://github.com/NauelG/astro-blocks/security/advisories/GHSA-mfcg-m7j5-7v72","tags":[]}],"exploitRefs":[{"url":"https://github.com/NauelG/astro-blocks/commit/fd83bf0b37a756363f718e134c16e448da09a74d","tags":[]},{"url":"https://github.com/NauelG/astro-blocks/pull/51","tags":[]},{"url":"https://github.com/NauelG/astro-blocks/releases/tag/v3.4.0","tags":[]},{"url":"https://github.com/NauelG/astro-blocks/security/advisories/GHSA-mfcg-m7j5-7v72","tags":[]}],"hasPoc":true,"ai":{"summary":"AstroBlocks prior to v3.4.0 uses a hard-coded JWT secret as a fallback, and due to an environment variable naming mismatch, attackers can bypass authentication by forging valid admin session tokens with 'owner' privileges. This allows full administrative control over the CMS, including content, user, and configuration manipulation.","exploitability":"Exploitation is trivial for attackers who know the publicly exposed fallback JWT secret (published in the package source); no authentication or user interaction is required.","blast_radius":"Successful exploitation grants full administrative access to the CMS, enabling complete compromise of content integrity, user data, and system configuration across all affected deployments.","remediation":"Upgrade to AstroBlocks version 3.4.0 or later, which patches the hard-coded secret and corrects the environment variable handling.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","jwt-forgery","hardcoded-secret","cms","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:54:05.139Z"}}