CVE-2026-56265CWE-798

Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key

Critical · published June 21, 2026

CVSS v4.0
9.3
EPSS
3%
Percentile
85.5
In the wild
Unconfirmed
What it is

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.02639 · 85.5th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-06-21T13:26Z
EPSS history
Timeline
  • 21 JUN 13:26Z
    Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key
    cvelistv5