Vulnerability · Published Jun 21, 2026 · Assigned by VulnCheck

CVE-2026-56265Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key

Critical 9.8

In plain English

A critical-severity hard-coded credentials in Crawl4AI from Crawl4AI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.6%top 14.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	crawl4ai	0.8.7	GHSA-365w-hqf6-vxfg
PyPI	crawl4ai	0.8.7	GHSA-8qrg-7j2f-rf2h
PyPI	crawl4ai	0.8.7	PYSEC-2026-229
PyPI	crawl4ai	0.8.7	PYSEC-2026-230
PyPI	crawl4ai	0.8.7	PYSEC-2026-239
PyPI	crawl4ai	0.8.7	PYSEC-2026-3443
PyPI	crawl4ai	0.8.7	PYSEC-2026-3449
PyPI	crawl4ai	0.8.7	PYSEC-2026-596
PyPI	crawl4ai	0.8.7	PYSEC-2026-798

Affected products (as reported)

Vendor	Product	Versions
Crawl4AI	Crawl4AI	0 – before 0.8.7

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg vendor-advisory
https://github.com/unclecode/crawl4ai product
VulnCheck Advisory: Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key third-party-advisory