PT-2026-29788 · Convoy · Convoy

Justlife4X4 · CVE-2026-33746 · Published 2026-04-02 · Updated 2026-04-03

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Convoy versions 3.9.0-beta through 4.5.0

Description Convoy, a KVM server management panel, had a flaw in the JWTService::decode() method where the cryptographic signature of JWT tokens was not verified. The validation process lacked the SignedWith constraint, allowing attackers to forge or modify JWT token payloads, specifically the user uuid claim, without invalidating the token as long as time-based claims were valid. This impacted the SSO authentication flow, enabling an attacker to authenticate as any user by crafting a token with an arbitrary user uuid.

Recommendations Update Convoy to version 4.5.1 or later.

Exploit

Fix

Improper Authentication

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-287

CWE-347

Related Identifiers

CVE-2026-33746

GHSA-92PG-3W49-4W5X

Affected Products

Convoy

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33746.json · Exploit
• https://github.com/ConvoyPanel/panel/security/advisories/GHSA-92pg-3w49-4w5x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33746 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33746 · Vendor Advisory
• https://github.com/ConvoyPanel/panel/releases/tag/v4.5.1 · Note
• https://twitter.com/0dayPublishing/status/2039729452729467320 · Twitter Post
• https://twitter.com/TheHackerWire/status/2040006400475300132 · Twitter Post
• https://twitter.com/CVEnew/status/2039744281942868244 · Twitter Post
• https://twitter.com/CveFindCom/status/2039745413922668977 · Twitter Post