Netmaker versions prior to 1.5.0 contain a vulnerability in the VerifyHostToken function where JWT signatures for host tokens are not properly validated. This allows an attacker to forge JWTs with arbitrary claims and retrieve sensitive host configuration data. The issue is fixed in version 1.5.0.