Vulnerability DatabaseCVE-2026-125758
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-125758
Published:November 10, 2026
Updated:November 12, 2026
Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTH_SECRET. Attackers can enumerate registered e-mails via /api/_auth/signin, forge HS256 JWTs redeemed by /api/_auth/continue, impersonate users, export analytics data, and transfer app ownership.
Related Resources (8)
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125758.json
https://www.vulncheck.com/advisories/aptabase-before-commit-61d4c01-authentication-bypass-via-known-example-auth-secret
https://github.com/aptabase/aptabase/commit/61d4c01298a706d575265461ac07bb956ca7b8d2
https://github.com/aptabase/aptabase
https://github.com/aptabase/aptabase/security/advisories/GHSA-gc76-cqm4-vqcf
https://github.com/aptabase/aptabase/pull/204
https://github.com/aptabase/self-hosting/commit/b79a472419ff17e485d0bd5b4adf1b1ef2b9953c
https://nvd.nist.gov/vuln/detail/CVE-2026-125758
Do you need more information?
Contact Us
CVSS v4
Base Score:
9.1
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
7.4
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Weakness Type (CWE)
Initialization of a Resource with an Insecure Default
CWE-1188
EPSS
Base Score:
0.34