Critical severity · published Jun 21, 2026
CVE-2026-56265
Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key
9.8
CVSS
2.6%
EPSS
No
On KEV
Description
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
Crawl4AI · Crawl4AI
before 0.8.7 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56265
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56265
Product
https://github.com/unclecode/crawl4ai
Mitigation
https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg
Third Party Advisory
https://www.vulncheck.com/advisories/crawl4ai-authentication-bypass-via-hardcoded-jwt-signing-key
More from Crawl4AI
9.1
CVE-2026-56260
Crawl4AI - Arbitrary File Write via output_path Parameter
8.6
CVE-2026-56266
Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints
8.2
CVE-2026-56259
Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution
8.1
CVE-2026-56258
Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU
7.5
CVE-2026-56261
Crawl4AI - Server-Side Request Forgery via Webhook URLs