{"id":"CVE-2026-64682","kind":"vulnerability","aliases":["CVE-2026-64682"],"related":[],"title":"AstroBlocks: forged admin session tokens grant full CMS control","description":"AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in the published package) can forge a valid session token with role: \"owner\" and obtain full administrative control of the CMS — creating/deleting content, users, media, redirects, and configuration. This issue has been patched in version 3.4.0.","summary":"AstroBlocks is a block-first content management system for Astro projects. Before version 3.4.0, it falls back to a hard-coded JWT signing secret visible in the published package, so an attacker can forge a session token with the owner role and gain full administrative control.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["astro","cms","javascript","package","self-hosted"],"not_affected_if":["admin-not-exposed","version-3.4.0-or-later"],"how_to_check":"- Check the installed AstroBlocks version in `package.json` or `npm ls astroblocks`\n- Look for a hard-coded JWT secret fallback in the session code of the installed package\n- Confirm whether the JWT secret environment variable is set in the deployment","fix":"- AstroBlocks: move to `3.4.0` or later","status":"open","published_at":"2026-11-11T05:19:52+00:00","first_seen_at":"2026-11-11T05:25:40+00:00","triaged_at":"2026-11-11T05:26:34+00:00","updated_at":"2026-11-11T05:26:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T05:26:34Z","model":"claude-haiku-5-5","output":{"fix":"- AstroBlocks: move to `3.4.0` or later","reach":"internet","title":"AstroBlocks: forged admin session tokens grant full CMS control","impact":"high","summary":"AstroBlocks is a block-first content management system for Astro projects. Before version 3.4.0, it falls back to a hard-coded JWT signing secret visible in the published package, so an attacker can forge a session token with the owner role and gain full administrative control.","audience":"developers","category":"package","nicknames":[],"who_cares":["astro","cms","self-hosted","javascript"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker gains full admin control, reads and deletes all content and users","analyst_note":"","how_to_check":"- Check the installed AstroBlocks version in `package.json` or `npm ls astroblocks`\n- Look for a hard-coded JWT secret fallback in the session code of the installed package\n- Confirm whether the JWT secret environment variable is set in the deployment","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-3.4.0-or-later","admin-not-exposed"],"who_is_affected":"Sites running the AstroBlocks CMS before 3.4.0 with its admin area reachable by an attacker. The flaw lies in the fallback signing secret used when the expected environment variable is missing or mismatched, so deployments that set the correct variable may not be exposed in the same way. Sites that do not run the admin panel publicly can skip it, though the sources do not say how the variable mismatch behaves in every configuration.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000757,"input_tokens":4639,"output_tokens":586,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-64682':12A,15A '3.4.0':37B,84C,150C 'admin':3A,85C 'administr':69B,131C 'astro':16B,33B,79C 'astroblock':1A,23B,71C 'attack':56B,107C 'back':40B 'block':27B,75C 'block-first':26B,74C 'cms':8A,17B,77C,135C 'code':45B,96C 'configur':142C 'content':29B,137C 'control':9A,70B,132C 'creating/deleting':136C 'cve':10A,13A 'due':91C 'environ':103C 'fall':39B 'fallback':97C,112C 'first':28B,76C 'forg':2A,58B,90C,120C 'full':7A,68B,130C 'gain':67B 'grant':6A 'hard':44B,95C 'hard-cod':43B,94C 'host':22B 'issu':144C 'javascript':18B 'jwt':46B,98C 'know':109C 'manag':30B 'media':139C 'mismatch':102C 'name':105C 'obtain':129C 'owner':64B,127C 'packag':19B,53B,118C 'patch':147C 'prior':81C 'project':34B,80C 'public':111C 'publish':52B,117C 'readabl':114C 'redirect':140C 'role':65B,126C 'secret':48B,99C 'self':21B 'self-host':20B 'session':4A,60B,86C,123C 'sign':47B 'system':31B 'token':5A,61B,87C,124C 'user':138C 'valid':122C 'valu':113C 'variabl':104C 'version':36B,83C,149C 'visibl':49B","nicknames":[],"mitigations":[],"who_affected":"Sites running the AstroBlocks CMS before 3.4.0 with its admin area reachable by an attacker. The flaw lies in the fallback signing secret used when the expected environment variable is missing or mismatched, so deployments that set the correct variable may not be exposed in the same way. Sites that do not run the admin panel publicly can skip it, though the sources do not say how the variable mismatch behaves in every configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["astro","cms","critical","javascript","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':11A,14A '-64682':12A,15A 'admin':3A 'astroblock':1A 'cms':8A 'control':9A 'cve':10A,13A 'forg':2A 'full':7A 'grant':6A 'session':4A 'token':5A","search_b":"'3.4.0':37B 'administr':69B 'astro':16B,33B 'astroblock':23B 'attack':56B 'back':40B 'block':27B 'block-first':26B 'cms':17B 'code':45B 'content':29B 'control':70B 'fall':39B 'first':28B 'forg':58B 'full':68B 'gain':67B 'hard':44B 'hard-cod':43B 'host':22B 'javascript':18B 'jwt':46B 'manag':30B 'owner':64B 'packag':19B,53B 'project':34B 'publish':52B 'role':65B 'secret':48B 'self':21B 'self-host':20B 'session':60B 'sign':47B 'system':31B 'token':61B 'version':36B 'visibl':49B","search_c":"'3.4.0':84C,150C 'admin':85C 'administr':131C 'astro':79C 'astroblock':71C 'attack':107C 'block':75C 'block-first':74C 'cms':77C,135C 'code':96C 'configur':142C 'content':137C 'control':132C 'creating/deleting':136C 'due':91C 'environ':103C 'fallback':97C,112C 'first':76C 'forg':90C,120C 'full':130C 'hard':95C 'hard-cod':94C 'issu':144C 'jwt':98C 'know':109C 'media':139C 'mismatch':102C 'name':105C 'obtain':129C 'owner':127C 'packag':118C 'patch':147C 'prior':81C 'project':80C 'public':111C 'publish':117C 'readabl':114C 'redirect':140C 'role':126C 'secret':99C 'session':86C,123C 'token':87C,124C 'user':138C 'valid':122C 'valu':113C 'variabl':104C 'version':83C,149C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-02T18:26:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-64682","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64682","severity":null,"published_at":"2026-11-11T05:19:52+00:00","modified_at":"2026-11-11T05:19:52+00:00","first_seen_at":"2026-11-11T05:25:40+00:00","fetched_at":"2026-11-11T05:25:40+00:00","note":null}],"documents":[{"id":122884,"url":"https://github.com/NauelG/astro-blocks/commit/fd83bf0b37a756363f718e134c16e448da09a74d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":122885,"url":"https://github.com/NauelG/astro-blocks/releases/tag/v3.4.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":122886,"url":"https://github.com/NauelG/astro-blocks/security/advisories/GHSA-mfcg-m7j5-7v72","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-02T18:26:40+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}