{"id":"CVE-2026-120442","aliases":[],"cve":{"records":[{"id":"CVE-2026-120442","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-02T12:42:16.749Z","published":"2026-11-02T14:29:03.407Z","modified":"2026-11-05T21:39:20.223Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-02T14:29:03.407Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-05T21:39:20.223Z"}],"references":[{"url":"https://github.com/xianhc/ape-volo-admin/issues/36","tags":["issue-tracking"],"source":"VulnCheck"},{"url":"https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933","tags":["patch"],"source":"VulnCheck"},{"url":"https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1","tags":["release-notes"],"source":"VulnCheck"},{"url":"https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Api/appsettings.json#L4-L10","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Extensions/AuthorizationExtensions.cs#L50-L60","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Authentication/PermissionHandler.cs#L130-L172","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://hackmd.io/@hieuPenguinnn/ape-volo-admin-hardcoded-jwt-secret-admin-token-forgery","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/ape-volo-admin-before-3.6.1-hardcoded-jwt-signing-key-authentication-bypass","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-1394","description":"Use of Default Cryptographic Key","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-05T21:38:59.409940Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.","score":9.8,"severity":"critical","published":"2026-11-02T14:29:03.407Z","modified":"2026-11-05T21:39:20.223Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"xianhc","name":"ape-volo-admin","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"3.6.1","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-120442"}],"remediation":[],"references":["https://github.com/xianhc/ape-volo-admin/issues/36","https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933","https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1","https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Api/appsettings.json#L4-L10","https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Extensions/AuthorizationExtensions.cs#L50-L60","https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Authentication/PermissionHandler.cs#L130-L172","https://hackmd.io/@hieuPenguinnn/ape-volo-admin-hardcoded-jwt-secret-admin-token-forgery","https://www.vulncheck.com/advisories/ape-volo-admin-before-3.6.1-hardcoded-jwt-signing-key-authentication-bypass"],"sources":[{"name":"CVE","id":"CVE-2026-120442","modified":"2026-11-05T21:39:20.223Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-120442"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"sourceAffected":[],"observedAt":"2026-11-05T22:38:54.125Z","kev":{"status":"not-listed","checkedAt":"2026-11-08T03:30:31.657Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-03T10:00:34.324Z","attemptedAt":"2026-11-03T10:00:34.324Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-03T10:00:34.041Z","attemptedAt":"2026-11-03T10:00:34.041Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-03T10:00:34.316Z","attemptedAt":"2026-11-03T10:00:34.316Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-03T10:00:33.810Z","attemptedAt":"2026-11-03T10:00:33.810Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-c4wp-cj2h-5rj2","url":"https://github.com/advisories/GHSA-c4wp-cj2h-5rj2","modified":"2026-11-02T15:31:45Z","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-03T10:00:34.041Z"},{"source":"ENISA EUVD","id":"EUVD-2026-115202","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-115202","modified":"Nov 2, 2026, 2:29:03 PM","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-11-03T10:00:34.316Z"},{"source":"NVD","id":"CVE-2026-120442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120442","modified":"2026-11-02T19:35:33.347","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-03T10:00:34.324Z"},{"source":"NVD","id":"CVE-2026-120442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120442","modified":"2026-11-02T19:35:33.347","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-03T10:00:34.324Z"}],"aiSummary":{"text":"Ape-volo-admin before 3.6.1 has a hardcoded JWT signing key, allowing unauthenticated attackers to forge administrator tokens and gain API control. The weakness is due to the use of a default cryptographic key. Attackers can sign tokens offline to bypass authentication.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-02T14:46:15.012Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-120442"}]}}