CVE-2023-37266 - CVE House
Back to Database
Status published Critical CVE-2023-37266

Weak json web token (JWT) secrets in CasaOS

Vulnerability Description

CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit `705bf1f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-37266

Credits & Attribution

No credits recorded in the NVD database.

References

More from IceWhaleTech

View All →
CVE-2025-64427
ZimaOS is vulnerable to Server-Side Request Forgery (SSRF)
High 7.1
CVE-2025-58432
ZimaOS Privilege Escalation using localhost calls to File API Upload
Medium 5.2
CVE-2025-58431
ZimaOS reads arbitrary files using localhost calls to File API Download
Medium 4.8
CVE-2024-49359
ZimaOS vulnerable to Directory Listing via Parameter Manipulation
High 7.5
CVE-2024-49358
ZimaOS vulnerable to Username Enumeration via API Responses
Medium 5.3

Affected Vendor

IceWhaleTech

View all reports →

Affected Software

CasaOS
Vulnerable Versions:
< 0.4.4

Timeline

Official Publish: July 17th, 2023
Last Modified: December 12th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-287

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access