clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example.
CVSS 4.0CRITICAL 9.3·Network·No auth·No interaction·EPSS 0.0067·Published 2026-07-17·Fixed in 0.7.5CWE-306