Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key
Description
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
Root cause
"Hardcoded default JWT signing key in the Docker API server allows token forgery."
Attack vector
An attacker who knows the hardcoded default JWT signing key can craft a forged authentication token for any user identity. By presenting this forged token to the Docker API server, the attacker bypasses all authentication checks and gains full access to protected API endpoints. No prior authentication or network position beyond reachability of the Docker API is required. [CWE-798]
Affected code
The Docker API server in Crawl4AI before version 0.8.7 uses a hardcoded default JWT signing key. This key is embedded in the server code that validates authentication tokens, allowing anyone who knows the default key to forge valid tokens.
What the fix does
The advisory states that version 0.8.7 is a 'Security-hardening release' that 'Fixes critical Docker API vulnerabilities (RCE, SSRF, auth bypass, file write, XSS, hardcoded JWT secret)'. The patch removes the hardcoded default JWT signing key and enforces that a unique, user-provided secret is used for token signing, preventing attackers from forging valid tokens without knowledge of the server-specific secret.
Preconditions
- networkThe attacker must be able to send HTTP requests to the Docker API server (network reachability).
- inputThe attacker must know the hardcoded default JWT signing key (publicly known from the source code).
Generated on Jun 22, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfgmitrevendor-advisory
- www.vulncheck.com/advisories/crawl4ai-authentication-bypass-via-hardcoded-jwt-signing-keymitrethird-party-advisory
News mentions
0No linked articles in our index yet.