Clawvet, a self‑hosted API server, embeds a hard‑coded JWT secret ('clawvet‑dev‑secret‑change‑me') in auth.ts before version 0.7.5. The default secret is also shipped in .env.example. Because the endpoint GET /api/v1/scans returns scan records containing userId values without requiring authentication, an attacker who can query the endpoint can harvest a victim’s userId. With the known secret, the attacker can construct a valid HS256 cg_session cookie offline and then call GET /api/v1/auth/me to obtain the victim’s email, subscription plan, and secret apiKey.

Vendor: MohibShaikh. Product: clawvet API server. Versions affected are all releases before 0.7.5; the advisory notes that only the server component (apps/api) is impacted and the npm package, which is CLI only, is not affected.

CVSS score of 9.3 indicates critical impact. The EPSS score of <1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack path is remote, unauthenticated: a client can simply request scan data, harvest the userId, forge a session cookie using the hard‑coded secret, and then query the personal information endpoint. The lack of authentication on the scans endpoint and the use of a predictable secret make exploitation straightforward once a victim’s userId is known.