GitHub Advisoryadvisory · PyPI

GHSA-8qrg-7j2f-rf2h Crawl4AI: authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server

CRITICAL Published 2026-06-21 Modified 2026-09-14 Official page ↗
Aliases
CVE-2026-56265
Ecosystem
PyPI
Packages
crawl4ai
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-798
Reviewed
2026-09-14

Affected packages

• PyPI crawl4ai: < 0.8.7 → fixed in 0.8.7

Description

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.

Related

Alias · CVE (1)

  • CVE-2026-56265 Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. vulnerability

Weakness · CWE (1)

  • CWE-798 Use of Hard-coded Credentials weakness

References