Live › vulnerability › CVE-2026-120442
ape-volo-admin ships a JWT signing key hardcoded in appsettings.json, so anyone who reads that file can sign tokens offline. A forged token with the seeded administrator id gives full API control over users, roles, permissions and data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Deployments of ape-volo-admin before 3.6.1 that use the default appsettings.json signing key are exposed, since the key is public in the configuration. Anyone running a patched version with a changed key, or not running this admin system, can skip it. unknown for whether the key is exposed in other forms.
No product ranges from the sources yet.
appsettings.json contains a hardcoded JWT signing key3.6.13.6.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.
This page as .md · .json · in your agent: get_signal("CVE-2026-120442")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.