{"id":"CVE-2026-111633","kind":"vulnerability","aliases":["CVE-2026-111633"],"related":[],"title":"ZKEACMS: hard-coded JWT signing key lets anyone forge admin API tokens","description":"ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.","summary":"ZKEACMS <= 4.4 validates REST API JWT bearer tokens with an HMAC-SHA256 key that is a const in src/ZKEACMS/Api/JwtBearerDefaults.cs, identical on every install and public in the repo. Anyone can sign a token as the default 'admin' user and call [ApiAuthorize] endpoints: edit articles and products, read form submissions. The cookie-based admin dashboard uses a separate scheme and the report does not show it is affected. No vendor fix exists yet.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ZKEACMS","fixed":[],"affected":"<= 4.4","ecosystem":"nuget"}],"ecosystems":[],"tags":["asp.net","package","self-hosted","zkeacms"],"not_affected_if":["api-disabled","api-not-exposed"],"how_to_check":"Check your ZKEACMS version (<= 4.4 is affected). In your source or build, open src/ZKEACMS/Api/JwtBearerDefaults.cs and look for a const IssuerSigningKey; if present, the install is exposed if the REST API is reachable. Check that the default 'admin' account from Database/script.sql exists.","fix":"No patched release as of 2026-10-24 (latest is v4.4). Workaround: block or restrict access to the REST API endpoints at the reverse proxy, or edit JwtBearerDefaults.cs and BuilderAuthentication.cs to load a random secret of 32+ bytes from configuration and rebuild; rename or remove the default 'admin' account. Rotating the key invalidates forged tokens.","status":"open","published_at":"2026-10-16T18:17:43+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:33:22+00:00","updated_at":"2026-10-24T00:25:46+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:33:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ZKEACMS: hard-coded JWT signing key lets anyone forge admin API tokens","impact":"medium","summary":"ZKEACMS through version 4.4 signs REST API JWT bearer tokens with an HMAC-SHA256 key hard-coded in JwtBearerDefaults.cs. An unauthenticated attacker can forge a token with the Name claim set to 'admin' and then edit articles and products or read form submissions.","category":"package","who_cares":["zkeacms","self-hosted","asp.net"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker forges admin tokens, editing content and reading form submissions.","analyst_note":"Confirm the fixed release and whether the key is configurable; the sources give neither a patched version nor a workaround.","how_to_check":"Search the deployed ZKEACMS source or package for JwtBearerDefaults.cs and check whether the signing key is the hard-coded value.\nunknown","needs_analyst":true,"not_affected_if":["api-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000502,"input_tokens":2957,"output_tokens":413,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed release and whether the key is configurable; the sources give neither a patched version nor a workaround.","search":"'-111633':16A,19A '-2026':15A,18A '4.4':28B,103C 'admin':11A,64B,81B,143C 'affect':95B 'allow':110C 'anyon':9A,56B 'api':12A,31B,116C 'apiauthor':68B,146C 'articl':71B,149C 'asp.net':21B 'attack':112C,132C 'authent':106C 'base':80B 'bearer':33B,118C 'bypass':107C 'call':67B,145C 'claim':140C 'code':4A,124C 'const':44B 'contain':104C 'cooki':79B 'cookie-bas':78B 'cve':14A,17A 'dashboard':82B 'default':63B 'edit':70B 'endpoint':69B,147C 'everi':49B 'exist':99B 'fix':98B 'forg':10A,114C 'form':75B,154C 'hard':3A,123C 'hard-cod':2A,122C 'hmac':38B,126C 'hmac-sha256':37B,125C 'host':25B 'ident':47B 'instal':50B 'jwt':5A,32B,117C 'jwtbearerdefaults.cs':131C 'key':7A,40B,129C 'let':8A 'modifi':148C 'name':139C 'packag':22B 'product':73B,151C 'public':52B 'read':74B,153C 'repo':55B 'report':89B 'rest':30B,115C 'scheme':86B 'self':24B 'self-host':23B 'separ':85B 'set':141C 'sha256':39B,127C 'show':92B 'sign':6A,58B,128C,134C 'src/zkeacms/api/jwtbearerdefaults.cs':46B 'submiss':76B,155C 'token':13A,34B,60B,119C,136C 'unauthent':111C 'use':83B,120C 'user':65B 'valid':29B 'vendor':97B 'vulner':108C 'yet':100B 'zkeacm':1A,26B,27B,101C 'zkeacms':20A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-111633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111633","severity":null,"published_at":"2026-10-16T18:17:43+00:00","modified_at":"2026-10-23T19:17:43+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111633:659","url":null,"severity":null,"published_at":"2026-10-24T00:25:46+00:00","modified_at":"2026-10-24T00:25:46+00:00","first_seen_at":"2026-10-24T00:25:46+00:00","fetched_at":"2026-10-24T00:25:46+00:00","note":"No patched release: v4.4 (12 May) is latest on GitHub releases; key is a compile-time const (IssuerSigningKey) in JwtBearerDefaults.cs, not configurable (per researcher hackmd + source). Researcher report is static review only, no runtime test; public write-up, no exploitation reported. X: 1 post in 7d, skipped. Issue #531 not read (gh/web fetch blocked)."}],"documents":[{"id":2600,"url":"https://hackmd.io/@hieuPenguinnn/zkeacms-hardcoded-jwt-signing-key-admin-auth-bypass","title":"ZKEACMS hard-coded JWT signing key admin auth bypass (hieuPenguinnn)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":2601,"url":"https://github.com/SeriaWei/ZKEACMS/blob/v4.4/src/ZKEACMS/Api/JwtBearerDefaults.cs","title":"JwtBearerDefaults.cs v4.4","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2603,"url":"https://www.vulncheck.com/advisories/zkeacms-through-4.4-authentication-bypass-via-hard-coded-jwt-signing-key","title":"VulnCheck advisory ZKEACMS <= 4.4","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2604,"url":"https://github.com/SeriaWei/ZKEACMS/releases","title":"ZKEACMS releases (latest v4.4)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}