# Cracker Barrel rewards admin panel vulnerability allowed API requests without an authorization token

DevFeed: [Cracker Barrel rewards admin panel vulnerability allowed API requests without an authorization token](<https://devfeed.tech/articles/a-cracker-barrel-vulnerability-32617.md>)

Original publisher: [Read original article](<https://eaton-works.com/2025/11/17/cracker-barrel-hack/>)

Author: Eaton

Published: 2025-11-17T15:31:02Z

Content type: article

Language: en

Sources: [Eaton Works Feed](<https://devfeed.tech/sources/eaton-works-feed.md>)

Topics: [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [api server](<https://devfeed.tech/topics/api-server.md>), [React](<https://devfeed.tech/topics/react.md>)

Tags: [admin](<https://devfeed.tech/tags/admin.md>), [api](<https://devfeed.tech/tags/api.md>), [api-server](<https://devfeed.tech/tags/api-server.md>), [auth](<https://devfeed.tech/tags/auth.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [panel](<https://devfeed.tech/tags/panel.md>), [react](<https://devfeed.tech/tags/react.md>), [third-party](<https://devfeed.tech/tags/third-party.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

The article describes a vulnerability in Cracker Barrel's rewards administration system. The author found that the React app's API server accepted requests without an authorization token, potentially allowing access to rewards management functions. No write actions were performed, no sensitive information was exposed, and the vulnerability appeared to be fixed by November 17, 2025.

## Source excerpt

Cracking open the rewards admin panel.