CVE-2026-85295: Account takeover in Chartbrew via JWT

CVE-2026-85295 is an authentication vulnerability in Chartbrew (open-source) that enables complete account takeover without credentials. The flaw resides in JWT fallback verification in verifyToken.js, verifyUser.js, getUserFromToken.js and socketManager.js. An attacker who knows the CB_SECRET value—often the default in stock or Docker Compose deployments—can forge a JWT with HS256 algorithm that the server accepts as valid, impersonating any user without password or 2FA.

The CVSS is 9.8 (critical). The vulnerability affects stock or Docker Compose repository deployments retaining a known, weak, or default CB_SECRET; it does not affect isolated containers where CB_SECRET is undefined. On November 6, the official NVD advisory was published, and on November 7 public signals emerged on X (3 posts in 24 hours, 28 interactions). No verified public exploit has been identified on GitHub.

Immediate action: upgrade Chartbrew to version 5.2.3 or later, where the JWT fallback has been removed. If you cannot upgrade immediately, verify the CB_SECRET value in all Chartbrew deployments: if it is the known default value, change it immediately to a random, strong value. Monitor access logs for unusual JWT tokens or access from unexpected IP addresses. If you run Chartbrew in production with sensitive data, treat this as a critical priority.