{"id":"CVE-2026-111690","kind":"vulnerability","aliases":["CVE-2026-111690"],"related":[],"title":"Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated…","description":"Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.","summary":"Simple Admin Core <= 1.8.7 ships the same JWT signing secret in api/etc/core.yaml and both docker-compose core.yaml files. Anyone can sign a JWT with roleId=001 (the seeded super-admin role) and reach every admin API. Instances that replaced the secret are not exposed. No upstream fix release exists; the secret is still in the shipped configs.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"simple-admin-core","fixed":[],"affected":"<= 1.8.7","ecosystem":"go"}],"ecosystems":[],"tags":["auth-bypass","go","hard-coded-secret","jwt","other","self-hosted","simple-admin-core"],"not_affected_if":["custom-access-secret","custom-secret"],"how_to_check":"Look at Auth.AccessSecret in your deployed core.yaml (api/etc/core.yaml, deploy/docker-compose/core-only/api/etc/core.yaml, deploy/docker-compose/all_in_one/postgresql/api/etc/core.yaml). If it equals jS6VKDtsJf3z1n2VKDtsJf3z1n2 you are exposed. Treat any such instance as already compromised: audit users and roles for unexpected super-admin grants.","fix":"No patched version yet (v1.8.7 is the latest release). Workaround: set a long random unique Auth.AccessSecret in every core.yaml (it must be the same across all APIs that decode the JWT), restart, which invalidates existing tokens. Then audit users, roles and API authorities. Do not expose the admin API publicly until done. Upstream PR #382 only replaces the secret in the example configs and is not merged.","status":"open","published_at":"2026-10-16T18:17:52+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:05:04+00:00","updated_at":"2026-10-23T23:29:51+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:05:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","impact":"high","summary":"Simple Admin Core through 1.8.7 has an authentication bypass that uses the hard-coded Auth.AccessSecret in api/etc/core.yaml to sign JWTs. An unauthenticated attacker can forge a super administrator token and gain full control over users, roles, menus, API authorities, configuration and tokens.","category":"other","who_cares":["simple-admin-core","go","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker gains full super administrator control over the application","analyst_note":"Find the fixed version or patch in the NVD entry or the upstream project advisory, and confirm whether the hard-coded secret was removed or made configurable.","how_to_check":"Check whether api/etc/core.yaml still contains the default Auth.AccessSecret value from the repository.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["custom-access-secret"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000797,"input_tokens":2800,"output_tokens":1034,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed version or patch in the NVD entry or the upstream project advisory, and confirm whether the hard-coded secret was removed or made configurable.","search":"'-111690':16A,19A '-2026':15A,18A '001':67B,140C '1.8.7':5A,44B,104C 'admin':2A,22A,39B,42B,72B,77B,101C 'administr':117C,144C 'allow':12A,111C 'anyon':60B 'api':78B,150C 'api/etc/core.yaml':52B,127C 'attack':113C,128C 'auth':25B 'auth-bypass':24B 'auth.accesssecret':125C 'authent':8A,107C 'author':151C 'bypass':9A,26B,108C 'claim':139C 'code':30B,124C 'compos':57B 'config':99B 'configur':152C 'contain':6A,105C 'control':145C 'core':3A,23A,40B,43B,102C 'core.yaml':58B 'cve':14A,17A 'docker':56B 'docker-compos':55B 'everi':76B 'exist':91B 'expos':86B 'file':59B 'fix':89B 'forg':115C 'full':143C 'gain':142C 'go':27B 'hard':29B,123C 'hard-cod':122C 'hard-coded-secret':28B 'host':36B 'instanc':79B 'jwt':32B,48B,64B,132C 'menus':149C 'public':135C 'reach':75B 'releas':90B 'replac':81B 'role':73B,148C 'roleid':66B,138C 'secret':31B,50B,83B,93B,136C 'seed':69B 'self':35B 'self-host':34B 'ship':45B,98B 'sign':49B,62B,130C 'simpl':1A,38B,41B,100C 'simple':21A 'simple-admin-cor':37B 'simple-admin-core':20A 'still':95B 'super':71B,116C 'super-admin':70B 'token':118C,154C 'unauthent':13A,112C 'upstream':88B 'use':120C 'user':147C 'vulner':10A,109C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111690","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111690","severity":null,"published_at":"2026-10-16T18:17:52+00:00","modified_at":"2026-10-19T14:16:59+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111690:454","url":null,"severity":null,"published_at":"2026-10-23T23:29:51+00:00","modified_at":"2026-10-23T23:29:51+00:00","first_seen_at":"2026-10-23T23:29:51+00:00","fetched_at":"2026-10-23T23:29:51+00:00","note":"No fixed release: latest is v1.8.7 (affected); mitigation PR #382 open/unmerged. Reporter write-up is source-read only, no runtime PoC; no exploitation seen. Did not search X."}],"documents":[{"id":2004,"url":"https://www.cve.org/CVERecord?id=CVE-2026-111690","title":"CVE Record CVE-2026-111690","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1999,"url":"https://hackmd.io/@hieuPenguinnn/simple-admin-core-hardcoded-jwt-accesssecret-admin-auth-bypass","title":"Simple Admin Core hard-coded JWT AccessSecret (reporter write-up, source-only, not executed)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2000,"url":"https://github.com/suyuan32/simple-admin-core/pull/382","title":"PR #382 Replace hardcoded JWT AccessSecret in example configs (open, unmerged)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":2001,"url":"https://github.com/suyuan32/simple-admin-core/releases","title":"simple-admin-core releases (latest v1.8.7)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}