---
title: Chartbrew: default CB_SECRET lets anyone forge JWTs for any user (GHSA-qvv4, CVSS 9.8) — rotate secrets and upgrade now | ctxsec
url: https://ctxsec.com/items/chartbrew-ghsa-default-cb-secret-jwt-account-takeover-cve-wave
description: "Chartbrew's GitHub advisories document a Critical account-takeover path (GHSA-qvv4-r3q6-8797, CVSS 9.8): API/websocket auth falls back to verifying bearer JWTs with CB_SECRET after CB_ENCRYPTION_KEY fails, and CB_SECRET ships in .env-template as the fixed placeholder change_to_random_string under a 'deprecated / unused' comment. A stock source or docker-compose install that keeps that placeholder accepts attacker-forged HS256 tokens for any numeric user id, bypassing password and 2FA. Sibling advisories in the same set cover BullMQ admin dashboard exposure, SQLi, SSRF, cross-tenant project takeover and more. CVE identifiers for the bundle became widely indexed around Nov 6 even though several GHSAs were published earlier."
status: "official (Chartbrew GitHub Security Advisories, incl. GHSA-qvv4-r3q6-8797 Critical CVSS 9.8); CVE records surfaced publicly around Nov 6 for the earlier advisory set; not in CISA KEV"
published: 2026-11-06
---

> Chartbrew's GitHub advisories document a Critical account-takeover path (GHSA-qvv4-r3q6-8797, CVSS 9.8): API/websocket auth falls back to verifying bearer JWTs with CB_SECRET after CB_ENCRYPTION_KEY fails, and CB_SECRET ships in .env-template as the fixed placeholder change_to_random_string under a 'deprecated / unused' comment. A stock source or docker-compose install that keeps that placeholder accepts attacker-forged HS256 tokens for any numeric user id, bypassing password and 2FA. Sibling advisories in the same set cover BullMQ admin dashboard exposure, SQLi, SSRF, cross-tenant project takeover and more. CVE identifiers for the bundle became widely indexed around Nov 6 even though several GHSAs were published earlier.

[← Cybersecurity News](/news) · [markdown](/items/chartbrew-ghsa-default-cb-secret-jwt-account-takeover-cve-wave.md)

official (Chartbrew GitHub Security Advisories, incl. GHSA-qvv4-r3q6-8797 Critical CVSS 9.8); CVE records surfaced publicly around Nov 6 for the earlier advisory set; not in CISA KEV

2026-11-06

### Chartbrew: default CB_SECRET lets anyone forge JWTs for any user (GHSA-qvv4, CVSS 9.8) — rotate secrets and upgrade now

- **Do now:** inspect `CB_SECRET` / `CB_ENCRYPTION_KEY`; if CB_SECRET is the template value or empty-but-set, treat the instance as fully compromised for session purposes — rotate both secrets, force re-login, and upgrade to the current Chartbrew release that rejects the old placeholder path.
- Review Chartbrew's security advisories list for the sibling Critical/High items (BullMQ dashboard, SSRF, SQLi, share-token forgery) on the same deploy.
- Internet-exposed Chartbrew with default env is the urgent case; air-gapped lab boxes still need the secret rotation before they are published.

Sources: [GitHub Advisory GHSA-qvv4-r3q6-8797: Full account takeover via JWTs under default CB_SECRET](https://github.com/chartbrew/chartbrew/security/advisories/GHSA-qvv4-r3q6-8797) · [Chartbrew security advisories index](https://github.com/chartbrew/chartbrew/security/advisories)