CVE-2026-120442: critical vulnerability in xianhc ape-volo-admin
ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
43Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 9.3epss 1.7%
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
xianhc · ape-volo-adminReferences
https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Api/appsettings.json#L4-L10https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Authentication/PermissionHandler.cs#L130-L172https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Extensions/AuthorizationExtensions.cs#L50-L60https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933https://github.com/xianhc/ape-volo-admin/issues/36https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1https://hackmd.io/@hieuPenguinnn/ape-volo-admin-hardcoded-jwt-secret-admin-token-forgeryhttps://www.vulncheck.com/advisories/ape-volo-admin-before-3.6.1-hardcoded-jwt-signing-key-authentication-bypass