---
id: "CVE-2026-111690"
kind: "vulnerability"
aliases: ["CVE-2026-111690"]
title: "Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "simple-admin-core", "fixed": [], "affected": "<= 1.8.7", "ecosystem": "go"}]
ecosystems: []
tags: ["auth-bypass", "go", "hard-coded-secret", "jwt", "other", "self-hosted", "simple-admin-core"]
not_affected_if: ["custom-access-secret", "custom-secret"]
published_at: "2026-10-16T18:17:52+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T23:29:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111690", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:29:51+00:00"}]
---

# Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated…

Simple Admin Core <= 1.8.7 ships the same JWT signing secret in api/etc/core.yaml and both docker-compose core.yaml files. Anyone can sign a JWT with roleId=001 (the seeded super-admin role) and reach every admin API. Instances that replaced the secret are not exposed. No upstream fix release exists; the secret is still in the shipped configs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:simple-admin-core affected <= 1.8.7 fixed ?

## How to check

Look at Auth.AccessSecret in your deployed core.yaml (api/etc/core.yaml, deploy/docker-compose/core-only/api/etc/core.yaml, deploy/docker-compose/all_in_one/postgresql/api/etc/core.yaml). If it equals jS6VKDtsJf3z1n2VKDtsJf3z1n2 you are exposed. Treat any such instance as already compromised: audit users and roles for unexpected super-admin grants.

## Fix

No patched version yet (v1.8.7 is the latest release). Workaround: set a long random unique Auth.AccessSecret in every core.yaml (it must be the same across all APIs that decode the JWT), restart, which invalidates existing tokens. Then audit users, roles and API authorities. Do not expose the admin API publicly until done. Upstream PR #382 only replaces the secret in the example configs and is not merged.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111690
- 2026-10-23T23:29:51+00:00 analyst — No fixed release: latest is v1.8.7 (affected); mitigation PR #382 open/unmerged. Reporter write-up is source-read only, no runtime PoC; no exploitation seen. Did not search X.

## Documents

- [advisory] CVE Record CVE-2026-111690 https://www.cve.org/CVERecord?id=CVE-2026-111690
- [describes] Simple Admin Core hard-coded JWT AccessSecret (reporter write-up, source-only, not executed) https://hackmd.io/@hieuPenguinnn/simple-admin-core-hardcoded-jwt-accesssecret-admin-auth-bypass
- [mentions] simple-admin-core releases (latest v1.8.7) https://github.com/suyuan32/simple-admin-core/releases
- [mitigation] PR #382 Replace hardcoded JWT AccessSecret in example configs (open, unmerged) https://github.com/suyuan32/simple-admin-core/pull/382

## From the sources

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_