Vulnerability Description
Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netmaker | Netmaker | < 1.5.0 |
Related Weaknesses (CWE)
References
- https://github.com/gravitl/netmaker/commit/5309aa70d464ef565911369714d661a61481aPatch
- https://www.zyenra.com/advisories/netmaker-jwt-verification-bypassExploitThird Party Advisory
- https://www.zyenra.com/blog/netmaker-jwt-verification-bypassExploitThird Party Advisory
- https://www.zyenra.com/advisories/netmaker-jwt-verification-bypass/ExploitThird Party Advisory
- https://www.zyenra.com/blog/netmaker-jwt-verification-bypassExploitThird Party Advisory
FAQ
What is CVE-2026-38651?
CVE-2026-38651 is a vulnerability with a CVSS score of 8.2 (HIGH). Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacke...
How severe is CVE-2026-38651?
CVE-2026-38651 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-38651?
Check the references section above for vendor advisories and patch information. Affected products include: Netmaker Netmaker.