Vulnerability Description
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kidocode | Crawl4Ai | < 0.8.7 |
Related Weaknesses (CWE)
References
- https://github.com/unclecode/crawl4aiProduct
- https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfgMitigationVendor Advisory
- https://www.vulncheck.com/advisories/crawl4ai-authentication-bypass-via-hardcodeThird Party Advisory
- https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfgMitigationVendor Advisory
FAQ
What is CVE-2026-56265?
CVE-2026-56265 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentica...
How severe is CVE-2026-56265?
CVE-2026-56265 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-56265?
Check the references section above for vendor advisories and patch information. Affected products include: Kidocode Crawl4Ai.