CVE-2026-64682 · Package
NO FIX YET · SEE WHAT TO DO
AstroBlocks is a block-first content management system for Astro projects. Before version 3.4.0, it falls back to a hard-coded JWT signing secret visible in the published package, so an attacker can forge a session token with the owner role and gain full administrative control.
first public Jul 2, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the AstroBlocks CMS before 3.4.0 with its admin area reachable by an attacker. The flaw lies in the fallback signing secret used when the expected environment variable is missing or mismatched, so deployments that set the correct variable may not be exposed in the same way. Sites that do not run the admin panel publicly can skip it, though the sources do not say how the variable mismatch behaves in every configuration.
Not affected if admin-not-exposed, version-3.4.0-or-later
Who cares astro, cms, javascript, self-hosted
package.json or npm ls astroblocks3.4.0 or laterAstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in the published package) can forge a valid session token with role: "owner" and obtain full administrative control of the CMS — creating/deleting content, users, media, redirects, and configuration. This issue has been patched in version 3.4.0.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.