CVE-2026-33746 is a critical authentication bypass vulnerability (CVSS 9.8) affecting Convoy KVM server management panel versions 3.9.0-beta through 4.5.0. The flaw stems from the JWTService::decode() method failing to verify cryptographic signatures on JWT tokens, despite configuring a signer. This allows an unauthenticated attacker to forge or tamper with token payloads, such as the user_uuid claim, and authenticate as any user. The vulnerability has a low attack complexity and can lead to a complete compromise of the system. While no active exploitation or public exploit code is currently reported, the issue has garnered some community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.5.1CPE matchmatch criteria | cpe:2.3:a:convoypanel:convoy:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.