Ghostwire

CVE-2026-38651: Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in...

HIGH CVSS 7.5

Published: April 28, 2026 | Last Modified: April 28, 2026

Description

Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information

Ghostwire Analysis — What This Means Practically

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Security Coverage (2 articles)

References