What’s Vulnerable › Vulnerabilities

CVE-2024-34354: CMSaasStarter: JWT Token Not Verified on Server Session

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-14 · updated 2026-06-17
• Weakness: CWE-345

Description

CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 are impacted. The issue is the user JWT Token is not verified on server session. You should take the patch 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 into your fork.

Affected products

• Critical Moments Cmsaasstarter: before 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 — fixed in 7904d416d2c72ec75f42fbf51e9e64fa74062ee6

How to fix

Upgrade to a fixed version: Critical Moments Cmsaasstarter 7904d416d2c72ec75f42fbf51e9e64fa74062ee6. Check the vendor advisory for mitigations.

References

• https://github.com/CriticalMoments/CMSaasStarter/commit/7904d416d2c72ec75f42fbf51e9e64fa74062ee6
• https://github.com/CriticalMoments/CMSaasStarter/pull/65
• https://github.com/CriticalMoments/CMSaasStarter/security/advisories/GHSA-qgcj-9rxf-rw7q
• https://github.com/CriticalMoments/CMSaasStarter/commit/7904d416d2c72ec75f42fbf51e9e64fa74062ee6
• https://github.com/CriticalMoments/CMSaasStarter/pull/65
• https://github.com/CriticalMoments/CMSaasStarter/security/advisories/GHSA-qgcj-9rxf-rw7q

Get alerted when CVE-2024-34354 or the next vulnerability affects your stack