CVE-2026-45223

The record

Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails to reject payloads containing an admin claim, allowing attackers to escalate privileges. An attacker with access to the shared non-admin token can craft a user-token payload with admin: true, sign it using HMAC-SHA256, and present it to admin-only coordinator routes to gain full coordinator admin access including lease visibility, pool state management, and forced release operations.

Affected packages

Related vulnerabilities

• CVE-2026-114640 Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its… CWE-290
• CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted… CWE-290
• CVE-2026-66674 Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions. CWE-290
• CVE-2026-82563 An attacker could impersonate the camera and place themselves in a man-in-the-middle or… CWE-290
• CVE-2026-82530 IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control… CWE-290
• CVE-2026-77089 Command Center API contained an authentication bypass issue affecting privilege… CWE-290
• CVE-2026-86478 In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in… CWE-290
• CVE-2026-84186 Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function… CWE-290