CVE-2026-120442
ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.
| CWE | CWE-1394 |
| Vendor | xianhc |
| Product | ape-volo-admin |
| Published | Nov 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for xianhc ape-volo-admin
Be the first to know when new critical vulnerabilities affecting xianhc ape-volo-admin are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
xianhc / ape-volo-admin
0 < 3.6.1
References
github.com: https://github.com/xianhc/ape-volo-admin/issues/36 github.com: https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933 github.com: https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1 github.com: https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Api/appsettings.json#L4-L10 github.com: https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Extensions/AuthorizationExtensions.cs#L50-L60 github.com: https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Authentication/PermissionHandler.cs#L130-L172 hackmd.io: https://hackmd.io/@hieuPenguinnn/ape-volo-admin-hardcoded-jwt-secret-admin-token-forgery vulncheck.com: https://www.vulncheck.com/advisories/ape-volo-admin-before-3.6.1-hardcoded-jwt-signing-key-authentication-bypass
Credits
hieuPenguinnn