CVE-2026-56265

critical · 9.3

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.

9.3

CVSS

2.6%

EPSS (exploit prob.)

85th

EPSS percentile

2026-06-21

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-798

Affected products

Vendor	Product	Affected versions
kidocode	crawl4ai	< 0.8.7

Check a specific version with /api/v1/cve/match.

References

https://github.com/unclecode/crawl4ai
https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg
https://www.vulncheck.com/advisories/crawl4ai-authentication-bypass-via-hardcoded-jwt-signing-key
https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-56265