CVE-2026-125758 json
Aptabase before commit 61d4c01 Authentication Bypass via Known Example AUTH_SECRET
published 6d ago modified yesterday also EUVD-2026-121241 , GHSA-gc76-cqm4-vqcf
Unreviewed: the maintainers' own advisory
Published by the maintainers on their GitHub repository aptabase/aptabase. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.
- cvss
- 7.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTH_SECRET. Attackers can enumerate registered e-mails via /api/_auth/signin, forge HS256 JWTs redeemed by /api/_auth/continue, impersonate users, export analytics data, and transfer app ownership.
Patch / fix
- github.com/aptabase/aptabase@61d4c01 commit
- github.com/aptabase/self-hosting@b79a472 commit
- github.com/aptabase/aptabase#204 pull request
Is CVE-2026-125758 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CNA | 4.0 | 9.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected products
- aptabase aptabase
Classification
- Weakness
-
- CWE-1188 Initialization of a Resource with an Insecure Default
References
-
github.com
/aptabase/aptabase/commit/61d4c01298a706d575265461ac07bb956ca7b8d2
patch
-
github.com
/aptabase/aptabase/pull/204
issue-tracking, patch
-
github.com
/aptabase/self-hosting/commit/b79a472419ff17e485d0bd5b4adf1b1ef2b9953c
patch
-
github.com
/aptabase/aptabase/security/advisories/GHSA-gc76-cqm4-vqcf
vendor-advisory, advisory
-
vulncheck.com
/advisories/aptabase-before-commit-61d4c01-authentication-bypass-via-known-example-auth-secret
third-party-advisory
Sources
- CVE List CVE-2026-125758
- NVD CVE-2026-125758
- Maintainer advisory GHSA-gc76-cqm4-vqcf
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of aptabase/aptabase published their own advisory on GitHub. Reviewed sources take precedence over it.