CVE-2026-45223 Details

A vulnerability allowing authentication bypass has been identified in Crabbox versions prior to 0.9.0. The issue arises in the coordinator user-token verification process, where the verifyUserToken() function improperly accepts payloads with admin claims. This flaw enables attackers to escalate privileges. An attacker with a shared non-admin token can create a user-token payload that includes an admin claim, sign it using HMAC-SHA256, and present it to admin-only coordinator routes. This exploitation grants full administrative access on the coordinator, including visibility into leases, management of pool states, and the ability to force release operations.

Users are advised to update to Crabbox version 0.9.0 or later, where this vulnerability has been fixed.