Critical JWT Bypass in Convoy Panel Allows Full Account Takeover

A critical CVE-2026-33746 vulnerability in Convoy’s JWT-based SSO (CVSS 9.8) omitted signature verification in JWTService::decode(), allowing attackers to forge tokens and authenticate as any user, including administrators. The flaw affects Convoy versions prior to 4.5.1, has no practical workaround, and is fixed by upgrading to v4.5.1 which adds the SignedWith constraint to validation.