CVE-2026-125758: Aptabase before commit 61d4c01 Authentication Bypass via Known Example AUTH_SECRET

Published Nov 10, 2026

Updated

Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTHSECRET. Attackers can enumerate registered e-mails via /api/auth/signin, forge HS256 JWTs redeemed by /api/auth/continue, impersonate users, export analytics data, and transfer app ownership.

Event History

Nov 10, 2026

CVE Published

via MITRE·03:22 PM

Data Sourced

via MITRE·03:22 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Aptabase deployments running a version before commit 61d4c01 are affected when they use the publicly known example AUTH_SECRET. An unauthenticated remote attacker can exploit the issue.

What can an attacker do after exploiting this issue?

An attacker can enumerate registered email addresses through /api/_auth/signin, forge HS256 JWT sign-in links, and redeem them at /api/_auth/continue. This can allow user impersonation, analytics-data export, and app-ownership transfer.

What should be checked during incident triage?

Check whether the deployment is before commit 61d4c01 and whether AUTH_SECRET is set to the publicly known example value. Review activity involving /api/_auth/signin and /api/_auth/continue for unexpected email enumeration, sign-in-link redemption, data exports, or ownership transfers.

CVE-2026-125758: Aptabase before commit 61d4c01 Authentication Bypass via Known Example AUTH_SECRET

Event History

Frequently Asked Questions

Which deployments are exposed?

What can an attacker do after exploiting this issue?

What should be checked during incident triage?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What can an attacker do after exploiting this issue?

What should be checked during incident triage?