CVE-2026-33746

Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signer via lcobucci/jwt, it only validated time-based claims (exp, nbf, iat) using the StrictValidAt constraint. The SignedWith constraint was not included in the validation step. This means an attacker could forge or tamper with JWT token payloads — such as modifying the user_uuid claim — and the token would be accepted as valid, as long as the time-based claims were satisfied. This directly impacts the SSO authentication flow (LoginController::authorizeToken), allowing an attacker to authenticate as any user by crafting a token with an arbitrary user_uuid. This issue has been patched in version 4.5.1.

• CWE-287
• CWE-347

• https://github.com/ConvoyPanel/panel/releases/tag/v4.5.1Release Notes
• https://github.com/ConvoyPanel/panel/security/advisories/GHSA-92pg-3w49-4w5xVendor Advisory

Published

Apr 2, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33740EspoCRM is an open source customer relationship management a…5.4
• CVE-2026-33741EspoCRM is an open source customer relationship management a…6.8
• CVE-2026-33742Invoice Ninja is a source-available invoice, quote, project …5.4
• CVE-2026-33743Incus is a system container and virtual machine manager. Pri…6.5
• CVE-2026-33744BentoML is a Python library for building online serving syst…7.8
• CVE-2026-33745cpp-httplib is a C++11 single-file header-only cross platfor…7.4
• CVE-2026-33747BuildKit is a toolkit for converting source code to build ar…9.8
• CVE-2026-33748BuildKit is a toolkit for converting source code to build ar…7.5
• CVE-2026-33749n8n is an open source workflow automation platform. Prior to…9
• CVE-2026-3375The LiteSpeed Cache plugin for WordPress is vulnerable to St…7.2
• CVE-2026-33750The brace-expansion library generates arbitrary strings cont…7.5
• CVE-2026-33751n8n is an open source workflow automation platform. Prior to…4.8