CVE-2026-125758

HIGH 7.4

Aptabase before commit 61d4c01 Authentication Bypass via Known Example AUTH_SECRET

CVSS Score

7.4

EPSS Score

0.0%

EPSS Percentile

0th

Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTH_SECRET. Attackers can enumerate registered e-mails via /api/_auth/signin, forge HS256 JWTs redeemed by /api/_auth/continue, impersonate users, export analytics data, and transfer app ownership.

CWE	CWE-1188
Vendor	aptabase
Product	aptabase
Published	Nov 10, 2026

Stay Ahead of the Next One

Get instant alerts for aptabase aptabase

Be the first to know when new high vulnerabilities affecting aptabase aptabase are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

aptabase / aptabase

0 < 61d4c01298a706d575265461ac07bb956ca7b8d2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/aptabase/aptabase/security/advisories/GHSA-gc76-cqm4-vqcf github.com: https://github.com/aptabase/aptabase/commit/61d4c01298a706d575265461ac07bb956ca7b8d2 github.com: https://github.com/aptabase/aptabase/pull/204 github.com: https://github.com/aptabase/self-hosting/commit/b79a472419ff17e485d0bd5b4adf1b1ef2b9953c vulncheck.com: https://www.vulncheck.com/advisories/aptabase-before-commit-61d4c01-authentication-bypass-via-known-example-auth-secret

Credits

GrayOM