Crawlab-team vulnerabilities
We track 2 vulnerabilities in Crawlab-team products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 14, 2026.
2vulnerabilities
1critical
1high
0exploited
9.3average CVSS score
Latest Crawlab-team vulnerabilities
- 9.8 Critical severity
crawlab: Use of Hard-coded Cryptographic Key
Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code
- 8.8 High severity
crawlab: Authorization Bypass Through User-Controlled Key
Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator cre