The vulnerability resides in the JWTService::decode() method where the cryptographic signature of JWT tokens was never validated. This omission allowed an attacker to forge or modify the token payload, such as changing the user_uuid claim, while still passing time‑based checks. As a result, authentication as any user was possible through the SSO flow without a valid login. The weakness is a clear abuse of authentication logic, letting an attacker gain unauthorized access to the platform.

ConvoyPanel:panel, a KVM server management panel used by hosting vendors, is affected in releases from version 3.9.0‑beta up to, but excluding, 4.5.1. The fix was introduced in 4.5.1, which implementation now verifies JWT signatures with the SignedWith constraint.

With a CVSS score of 9.8 the flaw is considered critical. No EPSS data is publicly available, but the lack of signature validation makes exploitation trivial for anyone who can craft a token. It is not listed in the CISA KEV catalog at the time of writing, yet organizations using the vulnerable ConvoyPanel version should treat it as a top‑priority risk. The most likely attack vector is the web interface's SSO authentication endpoint, where a crafted JWT can be submitted to obtain full user privileges.