Authentication Bypass Vulnerability in Aptabase by Aptabase

CVE-2026-125758

What is CVE-2026-125758?

Aptabase prior to commit 61d4c01 is vulnerable to an authentication bypass. This flaw allows unauthenticated attackers to forge sign-in links using the publicly available example AUTH_SECRET. Exploitation of this vulnerability can enable attackers to enumerate registered e-mail addresses through the /api/_auth/signin endpoint, create valid HS256 JWTs via /api/_auth/continue, impersonate legitimate users, extract sensitive analytics data, and even transfer application ownership. It is crucial for users to update their software to mitigate this risk.

References