AstroBlocks CMS Session Token Forgery Vulnerability

AstroBlocks, a block-first CMS for Astro projects, has a session token forgery vulnerability prior to version 3.4.0.

Admin session tokens can be forged because of a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value, readable in the published package, can forge a valid session token with role: owner.

• Affected versions: before 3.4.0
• Impact: full administrative control of the CMS, including creating/deleting content, users, media, redirects, and configuration
• Patched in: 3.4.0