CVE-2026-120442

EUVD-2026-115202
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Api/appsettings.json#L4-L10
https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Authentication/PermissionHandler.cs#L130-L172
https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Extensions/AuthorizationExtensions.cs#L50-L60
https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933
https://github.com/xianhc/ape-volo-admin/issues/36
https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1
https://hackmd.io/@hieuPenguinnn/ape-volo-admin-hardcoded-jwt-secret-admin-token-forgery
https://www.vulncheck.com/advisories/ape-volo-admin-before-3.6.1-hardcoded-jwt-signing-key-authentication-bypass