The vulnerability in ConvoyPanel's JWTService::decode() method arises because it does not enforce signature verification on JWT tokens, despite configuring an HMAC-SHA256 signer. The validation step only checks time-based claims (exp, nbf, iat) using the StrictValidAt constraint and omits the SignedWith constraint, which is necessary to verify the token's signature. Consequently, attackers can craft tokens with arbitrary payloads, such as a modified user_uuid, and bypass authentication controls in the LoginController::authorizeToken method. This improper authentication issue is tracked as CVE-2026-33746 and affects versions >= 3.9.0-beta and < 4.5.1. The vulnerability has a CVSS v3.1 score of 9.8 (critical) and was fixed in version 4.5.1.

Successful exploitation allows an unauthenticated attacker to bypass authentication by forging JWT tokens, effectively impersonating any user in the system. This leads to full compromise of confidentiality, integrity, and availability of the affected ConvoyPanel instance. The vulnerability impacts the SSO authentication flow, enabling unauthorized access without valid credentials.

Upgrade ConvoyPanel to version 4.5.1 or later, where the JWTService::decode() method correctly verifies JWT token signatures. This official fix fully addresses the vulnerability. No other mitigations are indicated or required once the patch is applied.