PT-2026-29788 · Convoy · Convoy

Justlife4X4 · Published 2026-04-02 · Updated 2026-04-03 · CVE-2026-33746

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Convoy versions 3.9.0-beta through 4.5.0

Description Convoy, a KVM server management panel, had a flaw in the JWTService::decode() method where the cryptographic signature of JWT tokens was not verified. The validation process lacked the SignedWith constraint, allowing attackers to forge or modify JWT token payloads, specifically the user uuid claim, without invalidating the token as long as time-based claims were valid. This impacted the SSO authentication flow, enabling an attacker to authenticate as any user by crafting a token with an arbitrary user uuid.

Recommendations Update Convoy to version 4.5.1 or later.

Fix

Improper Verification of Cryptographic Signature

Improper Authentication

Weakness Enumeration

CWE-347

CWE-287

Related Identifiers

CVE-2026-33746

Affected Products

Convoy

References · 7

• https://github.com/ConvoyPanel/panel/security/advisories/GHSA-92pg-3w49-4w5x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33746 · Security Note
• https://github.com/ConvoyPanel/panel/releases/tag/v4.5.1 · Note
• https://twitter.com/TheHackerWire/status/2040006400475300132 · Twitter Post
• https://twitter.com/0dayPublishing/status/2039729452729467320 · Twitter Post
• https://twitter.com/CveFindCom/status/2039745413922668977 · Twitter Post
• https://twitter.com/CVEnew/status/2039744281942868244 · Twitter Post