CVE

CVE-2026-120442

9.3

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

ape-volo-admin

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

ape-volo-admin <= 3.5.2 - Authentication Bypass via Hardcoded JWT Signing Key

ape-volo-admin References: https://github.com/xianhc/ape-volo-admin/issues/36 https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933 https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1 https://hackmd.io/@hieuPenguinnn/ape-volo-admin-hardcoded-jwt-secret-admin-token-forgery Remediation: Upgrade to version 3.6.1 or later.

10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: ape-volo-admin

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →