Session Token Vulnerability in Chartbrew Open-Source Web Application

CVE-2026-85295

What is CVE-2026-85295?

The Chartbrew open-source web application, which facilitates connection to databases and APIs for chart creation, has a vulnerability in its authentication mechanism prior to version 5.2.3. This flaw arises from the use of session tokens that accept weak or default values for the CB_SECRET. Attackers can exploit this weakness by sending a forged HS256 token that deceives the system into accepting it as a valid session for the target user, thus bypassing the need for valid credentials or two-factor authentication. This vulnerability primarily affects deployments using stock configurations or known weak secrets, allowing malicious actors to impersonate legitimate users and gain their privileges across the API and socket layers.

References