Session Token Forgery Vulnerability in AstroBlocks CMS by NauelG

CVE-2026-64682

What is CVE-2026-64682?

AstroBlocks, a block-first CMS for Astro projects, is susceptible to a session token forgery vulnerability prior to version 3.4.0. The root cause stems from a hard-coded fallback JWT secret coupled with a mismatched environment variable name. Malicious actors with knowledge of the publicly accessible fallback value can exploit this flaw by forging a valid session token designated for the 'owner' role. This exploitation can lead to unauthorized administrative control, enabling attackers to create or delete content, manage users, alter media, configure redirects, and adjust system settings. Users are strongly advised to upgrade to version 3.4.0 or later to mitigate this risk.

References