---
id: "CVE-2026-111633"
kind: "vulnerability"
aliases: ["CVE-2026-111633"]
title: "ZKEACMS: hard-coded JWT signing key lets anyone forge admin API tokens"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ZKEACMS", "fixed": [], "affected": "<= 4.4", "ecosystem": "nuget"}]
ecosystems: []
tags: ["asp.net", "package", "self-hosted", "zkeacms"]
not_affected_if: ["api-disabled", "api-not-exposed"]
published_at: "2026-10-16T18:17:43+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-24T00:25:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111633", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:25:46+00:00"}]
---

# ZKEACMS: hard-coded JWT signing key lets anyone forge admin API tokens

ZKEACMS <= 4.4 validates REST API JWT bearer tokens with an HMAC-SHA256 key that is a const in src/ZKEACMS/Api/JwtBearerDefaults.cs, identical on every install and public in the repo. Anyone can sign a token as the default 'admin' user and call [ApiAuthorize] endpoints: edit articles and products, read form submissions. The cookie-based admin dashboard uses a separate scheme and the report does not show it is affected. No vendor fix exists yet.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- nuget:ZKEACMS affected <= 4.4 fixed ?

## How to check

Check your ZKEACMS version (<= 4.4 is affected). In your source or build, open src/ZKEACMS/Api/JwtBearerDefaults.cs and look for a const IssuerSigningKey; if present, the install is exposed if the REST API is reachable. Check that the default 'admin' account from Database/script.sql exists.

## Fix

No patched release as of 2026-10-24 (latest is v4.4). Workaround: block or restrict access to the REST API endpoints at the reverse proxy, or edit JwtBearerDefaults.cs and BuilderAuthentication.cs to load a random secret of 32+ bytes from configuration and rebuild; rename or remove the default 'admin' account. Rotating the key invalidates forged tokens.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111633
- 2026-10-24T00:25:46+00:00 analyst — No patched release: v4.4 (12 May) is latest on GitHub releases; key is a compile-time const (IssuerSigningKey) in JwtBearerDefaults.cs, not configurable (per researcher hackmd + source). Researcher report is static review only, no runtime test; public write-up, no exploitation reported. X: 1 post in 7d, skipped. Issue #531 not read (gh/web fetch blocked).

## Documents

- [advisory] VulnCheck advisory ZKEACMS <= 4.4 https://www.vulncheck.com/advisories/zkeacms-through-4.4-authentication-bypass-via-hard-coded-jwt-signing-key
- [describes] JwtBearerDefaults.cs v4.4 https://github.com/SeriaWei/ZKEACMS/blob/v4.4/src/ZKEACMS/Api/JwtBearerDefaults.cs
- [mentions] ZKEACMS releases (latest v4.4) https://github.com/SeriaWei/ZKEACMS/releases
- [poc] ZKEACMS hard-coded JWT signing key admin auth bypass (hieuPenguinnn) https://hackmd.io/@hieuPenguinnn/zkeacms-hardcoded-jwt-signing-key-admin-auth-bypass

## From the sources

ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_