Live › vulnerability › CVE-2026-111690
Go to dashboardSimple Admin Core <= 1.8.7 ships the same JWT signing secret in api/etc/core.yaml and both docker-compose core.yaml files. Anyone can sign a JWT with roleId=001 (the seeded super-admin role) and reach every admin API. Instances that replaced the secret are not exposed. No upstream fix release exists; the secret is still in the shipped configs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| simple-admin-core | go | <= 1.8.7 | – |
v1.8.7 is the latest release)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.
This page as .md · .json · in your agent: get_signal("CVE-2026-111690")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.