Fullstep V5 Access Control Vulnerability Allowing Unauthenticated JWT Token Acquisition

A vulnerability exists in the registration process of Fullstep V5 due to inadequate access control. This flaw could enable unauthenticated users to obtain a valid JSON Web Token (JWT) and use it to access authenticated API resources. Exploiting this vulnerability could lead to unauthorized access to sensitive information, as the valid token would allow interaction with protected API endpoints.

Impact

Successful exploitation could allow an unauthenticated attacker to compromise the confidentiality of resources accessed through the API, using the acquired JWT token.

Remediation

Users can upgrade to Fullstep version 5.30.07, which has been available since January 29, 2026, to address this vulnerability.