Live › vulnerability › CVE-2026-111633
Go to dashboardZKEACMS <= 4.4 validates REST API JWT bearer tokens with an HMAC-SHA256 key that is a const in src/ZKEACMS/Api/JwtBearerDefaults.cs, identical on every install and public in the repo. Anyone can sign a token as the default 'admin' user and call [ApiAuthorize] endpoints: edit articles and products, read form submissions. The cookie-based admin dashboard uses a separate scheme and the report does not show it is affected. No vendor fix exists yet.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| ZKEACMS | nuget | <= 4.4 | – |
admin account from Database/script.sql existsadmin accountEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.
This page as .md · .json · in your agent: get_signal("CVE-2026-111633")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.