CVE-2026-38651

Published: Apr 28, 2026Modified: Jun 17, 2026

8.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Exploitability: 3.9 / Impact: 4.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information

Affected (1)

Products: Netmaker: Netmaker

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Netmaker Netmaker	Before 1.5.0

Related CWEs

Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References (5)

https://github.com/gravitl/netmaker/commit/5309aa70d464ef565911369714d661a61481a79b

Source: cve@mitre.org

Patch

https://www.zyenra.com/advisories/netmaker-jwt-verification-bypass

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.zyenra.com/blog/netmaker-jwt-verification-bypass

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.zyenra.com/advisories/netmaker-jwt-verification-bypass/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

https://www.zyenra.com/blog/netmaker-jwt-verification-bypass

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.