CVE-2026-125758 · Package
NO FIX YET · SEE WHAT TO DO
Aptabase before commit 61d4c01 accepts sign-in tokens signed with the publicly known example AUTH_SECRET, so anyone can forge login links. An attacker can impersonate users, export analytics data and transfer app ownership.
first public Nov 6, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted Aptabase instances that run a commit before 61d4c01 and use the publicly known example AUTH_SECRET are exposed, since forged JWTs are accepted by the sign-in continuation endpoint. Instances on the fixed commit with a unique secret are not described as affected by the sources.
Not affected if managed-hosting, unique-auth-secret
Who cares analytics, aptabase, self-hosted
AUTH_SECRET is still the example value from the project's sample configuration.61d4c01; anything older is listed as affected.61d4c01 (the fixed commit named in the description).AUTH_SECRET with a newly generated secret.Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTH_SECRET. Attackers can enumerate registered e-mails via /api/_auth/signin, forge HS256 JWTs redeemed by /api/_auth/continue, impersonate users, export analytics data, and transfer app ownership.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.