What’s Vulnerable › Vulnerabilities

CVE-2026-56265: Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-21 · updated 2026-06-26
• Weakness: CWE-798

Description

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.

Affected products

• unclecode crawl4ai: before 0.8.7 — fixed in 0.8.7

How to fix

Upgrade to a fixed version: unclecode crawl4ai 0.8.7. Check the vendor advisory for mitigations.

References

• https://github.com/unclecode/crawl4ai
• https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg
• https://www.vulncheck.com/advisories/crawl4ai-authentication-bypass-via-hardcoded-jwt-signing-key
• https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg

Get alerted when CVE-2026-56265 or the next vulnerability affects your stack