CVE-2026-34072 - Vulnerability Analysis

Overview

Cr*nMaster (cronmaster) < 2.2.0 contains an authentication bypass caused by middleware session-validation fetch failure, letting unauthenticated attackers access protected pages and execute privileged Next.js Server Actions, exploit requires invalid session cookie.

Severity & Score

Impact

Unauthenticated attackers can access protected pages and execute privileged server actions, leading to unauthorized access and potential system compromise.

Mitigation

Update to version 2.2.0 or later.

References

• https://github.com/fccview/cronmaster/security/advisories/GHSA-9whh-mffv-xvh6
• https://github.com/fccview/cronmaster/releases/tag/2.2.0

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner