CVE-2026-33746 Details

A vulnerability exists in Convoy, a KVM server management panel, in versions 3.9.0-beta prior to 4.5.1. The issue arises because the JWTService::decode() method fails to verify the cryptographic signature of JWT tokens. Although a symmetric HMAC-SHA256 signer was configured, the method only validated time-based claims using the StrictValidAt constraint, omitting the crucial SignedWith constraint. This oversight allows attackers to forge or manipulate JWT token payloads, such as altering the user_uuid claim, which would be accepted as valid if the time-based claims were in order. This vulnerability directly affects the SSO authentication process, enabling attackers to authenticate as any user by creating a token with a chosen user_uuid.

Users are advised to upgrade to Convoy version 4.5.1 or later, where this vulnerability has been patched by adding the necessary signature verification to the JWT validation process. For immediate security, installations should be updated to version 4.5.1.