Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64682— AstroBlocks: Admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name

Quick assessment

Affected
NauelG astro-blocks
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AstroBlocks 是一款专为 Astro 项目设计的“区块优先”内容管理系统（CMS）。在 3.4.0 版本之前，由于存在硬编码的备用 JWT 密钥以及环境变量名称不匹配的问题，攻击者可以伪造管理员会话令牌。若攻击者知晓该公开的备用密钥值（该值可在已发布的软件包中读取），即可伪造一个角色为"owner"的有效会话令牌，从而获得 CMS 的完整管理权限——包括创建或删除内容、用户、媒体资源、重定向规则及系统配置。该问题已在 3.4.0 版本中得到修复。

CVSS 9.8 · Critical EPSS 0.58% · P48

Affected Version Matrix 1

VendorProduct Version RangeStatus
NauelG astro-blocks < 3.4.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64682

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AstroBlocks: Admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name
Source: CVE Program / CVE List V5
Vulnerability Description
AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in the published package) can forge a valid session token with role: "owner" and obtain full administrative control of the CMS — creating/deleting content, users, media, redirects, and configuration. This issue has been patched in version 3.4.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的密码学密钥
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
NauelG astro-blocks < 3.4.0 -

II. Public POCs for CVE-2026-64682

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64682

请登录查看更多情报信息。

Other References for CVE-2026-64682 (4)

IV. Related Vulnerabilities

Same weakness: CWE-321