Description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, four authentication helpers accepted session tokens signed with CB_SECRET, including known, weak, or shipped-default values. The vulnerable surface is session JWT fallback in server/modules/verifyToken.js, verifyUser.js, getUserFromToken.js, and socketManager.js across the API and socket layer. A stock source or repository Docker Compose deployment retains a known, weak, or default CB_SECRET and an attacker submits a forged HS256 token decoding to a target user id. Knowing the symmetric secret lets the attacker create a token that the legacy verification fallback accepts as the target user without that user's password or two-factor authentication. The condition includes stock source and repository Docker Compose installs and any otherwise known or weak CB_SECRET; a bare container where CB_SECRET is undefined is not affected by this fallback path. A forged session impersonates the chosen user across the entire API and socket layer and exercises that user's Chartbrew privileges. This issue is fixed in version 5.2.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-06T21:17:10.890Z",
  "pubdate": "2026-11-06T21:17:10.890Z",
  "executiveSummary": "Chartbrew versions prior to 5.2.3 contain a critical authentication vulnerability involving improper JWT handling. The application employs a fallback mechanism that accepts session tokens signed with a static or predictable 'CB_SECRET'.\nThis flaw allows unauthorized actors to forge HS256-signed tokens, effectively impersonating any user within the system, including administrators, without requiring valid credentials or bypassing 2FA.\nThe vulnerability affects deployments utilizing default, known, or weak configurations for the 'CB_SECRET' environment variable, particularly within standard Docker Compose setups.\nThe impact is total account takeover and unauthorized access to the application's API and socket layer, granting an attacker full administrative control over the targeted user's data and privileges.\nMitigation requires an immediate update to version 5.2.3 and rigorous management of secret keys to prevent cryptographically weak token validation.",
  "technicalDetails": "The vulnerability resides in the server-side authentication logic of Chartbrew, specifically within 'server/modules/verifyToken.js', 'verifyUser.js', 'getUserFromToken.js', and 'socketManager.js'. These modules implement a fallback verification mechanism for session tokens that relies on the 'CB_SECRET' environment variable for HMAC SHA-256 (HS256) signature verification.\nRoot Cause: The application architecture includes a legacy fallback path that permits authentication via JWTs signed with the 'CB_SECRET'. When deployments use stock, default, or easily guessable secrets—often found in pre-configured Docker Compose environments—the security of the JWT verification process is entirely compromised. Because the secret key is symmetric and static, it provides sufficient material for an attacker to generate valid, signed tokens.\nAttack Flow: 1. Reconnaissance: An attacker identifies a target Chartbrew instance using a default or known 'CB_SECRET'. 2. Token Forgery: The attacker crafts a custom JWT payload specifying the 'userId' of a target account. 3. Signing: Utilizing the discovered or default 'CB_SECRET', the attacker signs the forged token using the HS256 algorithm. 4. Injection: The attacker submits this forged token via the 'Authorization' header or a socket connection request. 5. Verification Bypass: The vulnerable modules ('verifyToken.js', etc.) receive the token, fail to identify it as unauthorized, and accept the forged signature as legitimate because it validates correctly against the 'CB_SECRET'.\nExploitation requirements include network access to the API or socket layer and knowledge of the 'CB_SECRET'. The vulnerability is restricted to environments where the 'CB_SECRET' is explicitly set to a weak or default value; if the variable is undefined, the fallback mechanism remains inactive, and the application is not susceptible to this specific vector.\nPost-Exploitation: Once a forged token is accepted, the attacker inherits the security context of the impersonated user. This grants full access to the victim's privileges within the Chartbrew instance, allowing for data extraction, configuration changes, and unauthorized management of connected databases and APIs via the application's interface."
}