{"id":"CVE-2026-120442","published":"2026-11-02T15:17:26.490","lastModified":"2026-11-02T19:35:33.347","description":"ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-1394"],"vendors":[],"products":[],"references":[{"url":"https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Api/appsettings.json#L4-L10","tags":[]},{"url":"https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Authentication/PermissionHandler.cs#L130-L172","tags":[]},{"url":"https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Extensions/AuthorizationExtensions.cs#L50-L60","tags":[]},{"url":"https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933","tags":[]},{"url":"https://github.com/xianhc/ape-volo-admin/issues/36","tags":[]},{"url":"https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/ape-volo-admin-hardcoded-jwt-secret-admin-token-forgery","tags":[]},{"url":"https://www.vulncheck.com/advisories/ape-volo-admin-before-3.6.1-hardcoded-jwt-signing-key-authentication-bypass","tags":[]}],"exploitRefs":[{"url":"https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Api/appsettings.json#L4-L10","tags":[]},{"url":"https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Authentication/PermissionHandler.cs#L130-L172","tags":[]},{"url":"https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Extensions/AuthorizationExtensions.cs#L50-L60","tags":[]},{"url":"https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933","tags":[]},{"url":"https://github.com/xianhc/ape-volo-admin/issues/36","tags":[]},{"url":"https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1","tags":[]}],"hasPoc":true,"ai":{"summary":"ape-volo-admin before 3.6.1 uses a hardcoded JWT signing key in appsettings.json, enabling unauthenticated attackers to forge valid administrator tokens offline by signing them with the known key and setting the jti claim to the seeded admin ID.","exploitability":"Trivial to exploit; requires only knowledge of the hardcoded key (publicly discoverable via source code or config exposure) and the target admin's jti value.","blast_radius":"Full compromise of the application: attackers gain unrestricted API access to manage users, roles, permissions, and all data stored by the system.","remediation":"Upgrade to ape-volo-admin version 3.6.1 or later, which removes the hardcoded JWT signing key and implements secure key management.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","jwt","hardcoded-secret","admin-escalation"],"model":"garnet-coder","analyzedAt":"2026-11-03T09:54:39.822Z"}}