This vulnerability in Netmaker arises from improper validation of JWT signatures in the VerifyHostToken function located in logic/jwts.go. Because the function does not correctly verify the signature, an attacker can create forged JWTs with arbitrary signing keys. This enables impersonation of any host in the network, leading to unauthorized access to sensitive data. The issue affects versions prior to 1.5.0. The CVSS 3.1 base score is 8.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with limited integrity impact.

Successful exploitation allows an unauthenticated attacker to bypass authentication controls by forging JWT tokens, impersonating any host in the Netmaker network. This results in unauthorized access to sensitive information. The integrity impact is limited, and availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor vendor communications for updates. Until a fix is available, restricting network access to trusted hosts and minimizing exposure of Netmaker services may reduce risk.