{"id":"CVE-2026-110612","published":"2026-10-14T15:17:13.187","lastModified":"2026-10-16T19:18:44.867","description":"vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-321"],"vendors":[],"products":[],"references":[{"url":"https://github.com/wwwlike/vlife","tags":[]},{"url":"https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653f5b0d9a70721734d6d/vlife-base/src/main/java/cn/wwwlike/config/VlifeUrlDecisionManager.java#L25","tags":[]},{"url":"https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653f5b0d9a70721734d6d/vlife-boot-starter-web/src/main/java/cn/wwwlike/web/security/filter/TokenUtil.java#L33-L58","tags":[]},{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vlife-hardcoded-jwt-secret-token-forgery","tags":[]},{"url":"https://www.vulncheck.com/advisories/vlife-through-2.0.1-authentication-bypass-via-hardcoded-jwt-secret-in-tokenutil","tags":[]},{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vlife-hardcoded-jwt-secret-token-forgery","tags":[]}],"exploitRefs":[{"url":"https://github.com/wwwlike/vlife","tags":[]},{"url":"https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653f5b0d9a70721734d6d/vlife-base/src/main/java/cn/wwwlike/config/VlifeUrlDecisionManager.java#L25","tags":[]},{"url":"https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653f5b0d9a70721734d6d/vlife-boot-starter-web/src/main/java/cn/wwwlike/web/security/filter/TokenUtil.java#L33-L58","tags":[]}],"hasPoc":true,"ai":{"summary":"The vlife application contains a critical authentication bypass vulnerability due to a hardcoded HS256 signing key in TokenUtil, allowing attackers to forge JWT tokens with super administrator privileges and gain full access to any URL on affected instances.","exploitability":"The vulnerability is highly exploitable as it requires no authentication and allows attackers to easily forge valid JWT tokens with superUser=true claims, making exploitation straightforward with minimal preconditions.","blast_radius":"The impact is significant as attackers can gain complete administrative access to vlife instances, potentially compromising all user data, system configurations, and enabling further lateral movement within the affected environment.","remediation":"Upgrade to version 2.0.2 or later to address the hardcoded JWT signing key vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","jwt","authentication","web"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:48:08.235Z"}}