GHSA-8qrg-7j2f-rf2h

Crawl4AI: authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-56265

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	crawl4ai	< 0.8.7	0.8.7

Details

As written in the advisory (Markdown source, shown as plain text).

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.

References

External links from the advisory. They lead to third-party sites.

https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg web
https://nvd.nist.gov/vuln/detail/CVE-2026-56265 advisory
https://github.com/unclecode/crawl4ai package
https://github.com/unclecode/crawl4ai/releases/tag/v0.8.7 web
https://www.vulncheck.com/advisories/crawl4ai-authentication-bypass-via-hardcoded-jwt-signing-key web