Chartbrew’s authentication modules previously accepted session tokens signed with CB_SECRET even when the token payload was forged, and the secret could be a known or shipped‑default value. This flaw allowed an attacker to create an HS256 JSON Web Token that the fallback verification logic would accept as belonging to any target user, thereby circumventing passwords and two‑factor authentication and granting full access to the account and all chart‑generation services. The weakness is characterised as CWE‑1394: Reliance on Insecure Secret.

The vulnerability applies to all open‑source Chartbrew deployments that use chartbrew:chartbrew with a CB_SECRET that is a known, weak, or default value. In particular, stock source or repository Docker Compose configurations that ship a weak secret, as well as older releases prior to 5.2.3, are affected. Deployments where CB_SECRET is undefined are not impacted by the fallback path.

The CVSS base score for this flaw is 9.8, placing it in the Critical range. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is forging a JWT and submitting it to the API or socket layer, a step that can be performed remotely over HTTPS. Because the flaw grants impersonation across the entire application, the impact is total loss of confidentiality, integrity, and availability for the compromised account.