The clawvet self-hosted API server (apps/api) prior to version 0.7.5 contains a hard-coded fallback JWT secret ('clawvet-dev-secret-change-me') in its authentication configuration. The GET /api/v1/scans endpoint returns scan records with userId values without requiring authentication. An attacker can use the known JWT secret to forge a valid HS256 cg_session cookie offline and then call GET /api/v1/auth/me to retrieve sensitive user data including email, subscription plan, and secret API key. This vulnerability allows remote unauthenticated attackers to impersonate users and access confidential information. The published clawvet npm package (CLI only) is not vulnerable.

Remote unauthenticated attackers can harvest user IDs from an unauthenticated API endpoint, forge valid session cookies using a known hard-coded JWT secret, and access sensitive user information such as email addresses, subscription plans, and secret API keys. This compromises user confidentiality and authentication integrity, posing a critical security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid deploying versions prior to 0.7.5 or mitigate exposure by changing the default JWT secret and restricting access to the affected API endpoints. Monitor vendor channels for updates and apply patches promptly once released.