AstroBlocks CMS: Authentication bypass via hard-coded fallback JWT secret
Summary
AstroBlocks, a block-first CMS for Astro projects, signs admin session tokens with a hard-coded fallback JWT secret when the environment variable is not set or read correctly. The fallback value is publicly readable in the published package. An unauthenticated attacker can forge a session token with the owner role and gain full administrative control over content, users, media, redirects and configuration. The CNA rates this vulnerability 9.8 (critical).
Affected
- AstroBlocks (NauelG astro-blocks, npm @astroblocks/astro-blocks) versions before 3.4.0
Fixed in
- Upgrade to version 3.4.0 or later
Workaround
- Unknown. No vendor-documented workaround found.
- Interim measure (not vendor guidance): restrict access to /cms at the reverse proxy or firewall, for example via VPN or IP allowlist, until the upgrade is complete.
Exploitation
- No evidence of exploitation in the wild; not listed in CISA KEV.
- No public exploit known at publication. The fallback secret is in the published package, so an exploit is likely easy to build.
- Attack vector is network, no privileges or user interaction required.
Our recommendation
- Upgrade AstroBlocks to 3.4.0 or later immediately, if /cms is reachable from the internet.
- Set ASTRO_BLOCKS_JWT_SECRET to a long random value (32+ characters) in production; without it, login returns 503.
- Restrict /cms access until the upgrade is done.
- After upgrading, invalidate existing sessions and review user accounts and content for unexpected owner accounts or changes.
- If an affected version was internet-reachable, treat the instance as potentially compromised.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-mfcg-m7j5-7v72 github.com
- Fix commit fd83bf0 github.com
- Pull Request #51 github.com
- Release v3.4.0 github.com
- VulDB entry 435604 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:20.
Original description (NVD)
AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in the published package) can forge a valid session token with role: "owner" and obtain full administrative control of the CMS — creating/deleting content, users, media, redirects, and configuration. This issue has been patched in version 3.4.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.