{"affected":[{"product":"astro-blocks","source":"CNA: GitHub_M","vendor":"NauelG","versions":[{"status":"affected","version":"< 3.4.0"}]}],"cveId":"CVE-2026-64682","cwes":["CWE-321","CWE-798"],"description":"AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in the published package) can forge a valid session token with role: \"owner\" and obtain full administrative control of the CMS — creating/deleting content, users, media, redirects, and configuration. This issue has been patched in version 3.4.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.8,"severity":"critical","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794369849388,"publishedAt":1794369849388,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/NauelG/astro-blocks/security/advisories/GHSA-mfcg-m7j5-7v72"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/NauelG/astro-blocks/pull/51"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/NauelG/astro-blocks/commit/fd83bf0b37a756363f718e134c16e448da09a74d"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/NauelG/astro-blocks/releases/tag/v3.4.0"}],"remediation":[],"revision":"7feeb5d480830f994ab7b527e94ab307f42b82f81bd5854e1240d7d67090c3d7","sources":[{"modifiedAt":1794369849388,"name":"CNA: GitHub_M","retrievedAt":1794370182164,"url":"https://www.cve.org/CVERecord?id=CVE-2026-64682"}],"ssvc":null,"status":"published","title":"AstroBlocks: Admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name","updatedAt":1794370182164}