TI-2023-18896 Aliases CVE-2023-37266 GHSA-m5q5-8mfw-p2hr

Weak json web token (JWT) secrets in CasaOS

MEDIUM 59CWE-287Published 2023-07-17 · Updated 2024-12-12

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit `705bf1f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.06844 94th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed CasaOS (IceWhaleTech): 0.4.4github.com/IceWhaleTech/CasaOS (Go): 0.4.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
IceWhaleTech	CasaOS	before 0.4.4	0.4.4	Patch available	CNA
—	github.com/IceWhaleTech/CasaOS (Go)	before 0.4.4	0.4.4	Patch available	GHSA-m5q5-8mfw-p2hr

CasaOS VendorIceWhaleTech Affected before 0.4.4 Fixed in 0.4.4 Patch available CNA
github.com/IceWhaleTech/CasaOS (Go) Vendor— Affected before 0.4.4 Fixed in 0.4.4 Patch available GHSA-m5q5-8mfw-p2hr

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:o:icewhale:casaos::::::::	before 0.4.4	Vulnerable	IceWhaleTech

cpe:2.3:o:icewhale:casaos:*:*:*:*:*:*:*:* Versions before 0.4.4 Vulnerable ·IceWhaleTech

Remediation

Fix · CNA CasaOS (IceWhaleTech) Fixed in 0.4.4
Fix · GHSA-m5q5-8mfw-p2hr github.com/IceWhaleTech/CasaOS (Go) Fixed in 0.4.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-37266
2026-10-03 Alias added: GHSA-m5q5-8mfw-p2hr

References

Exploit 1

https://www.sonarsource.com/blog/security-vulnerabilities-in-casaos

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2023-37266

Other 2

TI-2024-16284 CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability CVSS 3.1CRITICAL 9.8
TI-2024-16282 CasaOS-UserService allows unauthorized access to any file CVSS 3.1CRITICAL 9.8
TI-2023-19077 CasaOS Command Injection vulnerability CVSS 3.1HIGH 8.8
TI-2023-18895 Incorrect identification of source IP addresses in CasaOS CVSS 3.1CRITICAL 9.8
TI-2022-08122 CasaOS before v0.2.7 was discovered to contain a command injection vulnerability. CVSS 3.1CRITICAL 9.8
TI-2025-24320 CasaOS <= 0.4.15 Unauthenticated File and Debug Data Exposure CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences