CVE-2026-110612

CRITICAL 9.8

vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.

CWE	CWE-321
Vendor	wwwlike
Product	vlife
Published	Oct 14, 2026
Last Updated	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for wwwlike vlife

Be the first to know when new critical vulnerabilities affecting wwwlike vlife are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

wwwlike / vlife

0 ≤ 2.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vlife-hardcoded-jwt-secret-token-forgery github.com: https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653f5b0d9a70721734d6d/vlife-boot-starter-web/src/main/java/cn/wwwlike/web/security/filter/TokenUtil.java#L33-L58 github.com: https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653f5b0d9a70721734d6d/vlife-base/src/main/java/cn/wwwlike/config/VlifeUrlDecisionManager.java#L25 github.com: https://github.com/wwwlike/vlife vulncheck.com: https://www.vulncheck.com/advisories/vlife-through-2.0.1-authentication-bypass-via-hardcoded-jwt-secret-in-tokenutil

Credits

hieuPenguinnn