{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33746", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-23T18:30:14.124Z", "datePublished": "2026-04-02T15:06:05.832Z", "dateUpdated": "2026-04-02T18:50:14.459Z"}, "containers": {"cna": {"title": "Convoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary Users", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/ConvoyPanel/panel/security/advisories/GHSA-92pg-3w49-4w5x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ConvoyPanel/panel/security/advisories/GHSA-92pg-3w49-4w5x"}, {"name": "https://github.com/ConvoyPanel/panel/releases/tag/v4.5.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/ConvoyPanel/panel/releases/tag/v4.5.1"}], "affected": [{"vendor": "ConvoyPanel", "product": "panel", "versions": [{"version": ">= 3.9.0-beta, < 4.5.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-02T15:06:05.832Z"}, "descriptions": [{"lang": "en", "value": "Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signer via lcobucci/jwt, it only validated time-based claims (exp, nbf, iat) using the StrictValidAt constraint. The SignedWith constraint was not included in the validation step. This means an attacker could forge or tamper with JWT token payloads \u2014 such as modifying the user_uuid claim \u2014 and the token would be accepted as valid, as long as the time-based claims were satisfied. This directly impacts the SSO authentication flow (LoginController::authorizeToken), allowing an attacker to authenticate as any user by crafting a token with an arbitrary user_uuid. This issue has been patched in version 4.5.1."}], "source": {"advisory": "GHSA-92pg-3w49-4w5x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T18:49:33.555330Z", "id": "CVE-2026-33746", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T18:50:14.459Z"}}]}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signer via lcobucci/jwt, it only validated time-based claims (exp, nbf, iat) using the StrictValidAt constraint. The SignedWith constraint was not included in the validation step. This means an attacker could forge or tamper with JWT token payloads \u2014 such as modifying the user_uuid claim \u2014 and the token would be accepted as valid, as long as the time-based claims were satisfied. This directly impacts the SSO authentication flow (LoginController::authorizeToken), allowing an attacker to authenticate as any user by crafting a token with an arbitrary user_uuid. This issue has been patched in version 4.5.1."}], "id": "CVE-2026-33746", "lastModified": "2026-04-02T16:16:22.803", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-04-02T16:16:22.803", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ConvoyPanel/panel/releases/tag/v4.5.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/ConvoyPanel/panel/security/advisories/GHSA-92pg-3w49-4w5x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-347"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.9.0-beta,4.5.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "panel", "source": "cna", "vendor": "ConvoyPanel"}, "product": "panel", "vendor": "convoypanel"}], "analysis": {"en": {"generated_at": "2026-04-02T16:20:51.497160+00:00", "value": {"mitigation_remediation": ["Upgrade ConvoyPanel to version 4.5.1 or later, which restores JWT signature verification.", "Confirm that the updated login flow is active and that only signed tokens are accepted.", "Validate that user_uuid values cannot be arbitrarily set by testing with a fabricated token and reviewing logs for rejected attempts."], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "ConvoyPanel:panel, a KVM server management panel used by hosting vendors, is affected in releases from version 3.9.0\u2011beta up to, but excluding, 4.5.1. The fix was introduced in 4.5.1, which implementation now verifies JWT signatures with the SignedWith constraint.", "description_and_impact": "The vulnerability resides in the JWTService::decode() method where the cryptographic signature of JWT tokens was never validated. This omission allowed an attacker to forge or modify the token payload, such as changing the user_uuid claim, while still passing time\u2011based checks. As a result, authentication as any user was possible through the SSO flow without a valid login. The weakness is a clear abuse of authentication logic, letting an attacker gain unauthorized access to the platform.", "risk_and_exploitability": "With a CVSS score of 9.8 the flaw is considered critical. No EPSS data is publicly available, but the lack of signature validation makes exploitation trivial for anyone who can craft a token. It is not listed in the CISA KEV catalog at the time of writing, yet organizations using the vulnerable ConvoyPanel version should treat it as a top\u2011priority risk. The most likely attack vector is the web interface's SSO authentication endpoint, where a crafted JWT can be submitted to obtain full user privileges."}}}}, "created": "2026-04-02T20:11:30.352534+00:00", "updated": "2026-04-02T20:20:11.930357+00:00", "vendors": ["convoypanel", "convoypanel$PRODUCT$panel"]}