CVE-2026-57183
Deferred Deferred - Pending Action

Authentication Bypass in Scoold via JWT Forgery

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, checkApiAuth() in src/main/java/com/erudika/scoold/utils/ScooldUtils.java accepts a JWT signed with app_secret_key or para_secret_key for /api/config and /api/stats without requiring a registered API-key jti, and maps the request to the hardcoded administrative API_USER. The special endpoint checks run even when scoold.api_enabled is false. An attacker who obtains either signing secret can forge a token that reads sensitive configuration and server logs and reaches privileged configuration functionality, while an ordinary login-session token is not sufficient. This issue is fixed in version 1.69.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-57183
EUVD
EUVD-2026-102313

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Erudika scoold < 1.69.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Scoold, a Q&A platform, where an attacker with access to either the app_secret_key or para_secret_key can forge a JWT token to access administrative functions without a valid API key. The issue lies in the checkApiAuth() function which improperly validates tokens for specific endpoints (/api/config and /api/stats), allowing unauthorized access to sensitive data and configuration even when API access is disabled.

Detection Guidance

Detecting this vulnerability requires checking if your Scoold instance is running a version prior to 1.69.1. Use commands like 'curl -s http://your-scoold-server/version' or check the application logs for version information. Verify if the /api/config and /api/stats endpoints are accessible without proper API-key jti validation.

Impact Analysis

If exploited, this vulnerability could allow an attacker to read sensitive server logs, access configuration details, and perform privileged actions without proper authorization. This could lead to data breaches, unauthorized modifications, or disruption of the Scoold platform.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using Scoold may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade Scoold to version 1.69.1 or later immediately. Rotate both app_secret_key and para_secret_key to invalidate any potentially compromised tokens. Ensure API-key jti validation is enforced for /api/config and /api/stats endpoints. Disable these endpoints if not needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57183. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart