{"id":"CVE-2026-125383","published":"2026-11-10T00:17:11.510","lastModified":"2026-11-10T00:17:11.510","description":"INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-321"],"vendors":[],"products":[],"references":[{"url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System","tags":[]},{"url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/blob/v9.20250118/Presentation/ASPNET/appsettings.json#L38-L44","tags":[]},{"url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/65609b5b88cb4f156e8164f33b8db8c63f5c125b","tags":[]},{"url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/ded7d8a9457c780dfd4f5ea74d7e72111fafaea6","tags":[]},{"url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/issues/48","tags":[]},{"url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/releases/tag/v10.20261109","tags":[]},{"url":"https://www.vulncheck.com/advisories/indotalent-whms-before-10.20261109-hard-coded-jwt-signing-key-authentication-bypass","tags":[]}],"exploitRefs":[{"url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System","tags":[]},{"url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/blob/v9.20250118/Presentation/ASPNET/appsettings.json#L38-L44","tags":[]},{"url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/65609b5b88cb4f156e8164f33b8db8c63f5c125b","tags":[]},{"url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/ded7d8a9457c780dfd4f5ea74d7e72111fafaea6","tags":[]},{"url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/issues/48","tags":[]},{"url":"https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/releases/tag/v10.20261109","tags":[]}],"hasPoc":true,"ai":{"summary":"The INDOTALENT WHMS application uses a hard-coded JWT signing key, issuer, and audience in its appsettings.json file, allowing unauthenticated attackers to forge valid authentication tokens for any user role, including administrator. This authentication bypass enables full API access without credentials.","exploitability":"Exploitation is trivial for remote attackers with no prerequisites beyond network access to the API, as the signing key and token parameters are publicly embedded in configuration files.","blast_radius":"Successful exploitation grants full administrative control over the entire API, enabling complete data exfiltration, system modification, or service disruption across all affected instances.","remediation":"Upgrade to version 10.20261109 or later, which removes the hard-coded JWT credentials and enforces secure key management.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","jwt","hardcoded-secret","web","api"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:44:55.999Z"}}