CVE-2026-125758 Aptabase before commit 61d4c01 Authentication Bypass via Known Example AUTH_SECRET
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-125758?
CVE-2026-125758 is a critical vulnerability in aptabase, published on 10 Nov 2026.
Official description
Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTH_SECRET. Attackers can enumerate registered e-mails via /api/_auth/signin, forge HS256 JWTs redeemed by /api/_auth/continue, impersonate users, export analytics data, and transfer app ownership.
Weakness: CWE-1188
Which versions are affected by CVE-2026-125758?
How do I fix CVE-2026-125758?
No fix has been published for CVE-2026-125758 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-125758 being exploited?
There is no known exploitation of CVE-2026-125758 in the wild and no public exploit code.
Sources
Also known as GHSA-gc76-cqm4-vqcf, GHSA-q925-46h4-fq6w.