{"id":"CVE-2026-120442","kind":"vulnerability","aliases":["CVE-2026-120442"],"related":[],"title":"ape-volo-admin: hardcoded JWT key lets attackers forge admin tokens","description":"ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.","summary":"ape-volo-admin ships a JWT signing key hardcoded in appsettings.json, so anyone who reads that file can sign tokens offline. A forged token with the seeded administrator id gives full API control over users, roles, permissions and data.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["admin-panel","ape-volo-admin","other","self-hosted"],"not_affected_if":["changed-jwt-key","version-3.6.1-or-later"],"how_to_check":"- Check whether the deployed `appsettings.json` contains a hardcoded JWT signing key\n- Check the installed ape-volo-admin version is below `3.6.1`","fix":"- ape-volo-admin: move to `3.6.1` or later","status":"open","published_at":"2026-11-02T15:17:26+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","triaged_at":"2026-11-02T15:25:39+00:00","updated_at":"2026-11-02T15:25:39+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-02T15:25:39Z","model":"claude-haiku-5-5","output":{"fix":"- ape-volo-admin: move to `3.6.1` or later","reach":"internet","title":"ape-volo-admin: hardcoded JWT key lets attackers forge admin tokens","impact":"high","summary":"ape-volo-admin ships a JWT signing key hardcoded in appsettings.json, so anyone who reads that file can sign tokens offline. A forged token with the seeded administrator id gives full API control over users, roles, permissions and data.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ape-volo-admin","self-hosted","admin-panel"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker gains full administrator control over users, roles and data","analyst_note":"Confirm the affected version range and whether the hardcoded key is the only exposure, using the NVD entry and the linked release notes.","how_to_check":"- Check whether the deployed `appsettings.json` contains a hardcoded JWT signing key\n- Check the installed ape-volo-admin version is below `3.6.1`\n- unknown for other checks","plain_action":"","needs_analyst":true,"not_affected_if":["version-3.6.1-or-later","changed-jwt-key"],"who_is_affected":"Deployments of ape-volo-admin before 3.6.1 that use the default appsettings.json signing key are exposed, since the key is public in the configuration. Anyone running a patched version with a changed key, or not running this admin system, can skip it. unknown for whether the key is exposed in other forms.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000705,"input_tokens":4198,"output_tokens":570,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-120442':15A,18A '-2026':14A,17A '3.6.1':75C 'admin':4A,11A,20B,25B,33B,73C 'admin-panel':19B 'administr':58B,87C,110C 'allow':82C 'anyon':43B 'ape':2A,23B,31B,71C 'ape-volo-admin':1A,22B,30B,70C 'api':62B,115C 'appsettings.json':41B,96C 'attack':9A,84C,97C 'authent':78C 'bypass':79C 'claim':105C 'contain':76C 'control':63B,116C 'cve':13A,16A 'data':69B,122C 'file':47B 'forg':10A,53B,86C 'full':61B,114C 'gain':113C 'give':60B 'hardcod':5A,39B,91C 'host':29B 'id':59B,111C 'jti':104C 'jwt':6A,36B,92C 'key':7A,38B,94C 'let':8A 'offlin':51B,101C 'panel':21B 'permiss':67B,120C 'read':45B 'role':66B,119C 'seed':57B,109C 'self':28B 'self-host':27B 'set':106C 'ship':34B 'sign':37B,49B,93C,99C 'token':12A,50B,54B,88C,100C 'unauthent':83C 'use':89C 'user':65B,118C 'volo':3A,24B,32B,72C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Deployments of ape-volo-admin before 3.6.1 that use the default appsettings.json signing key are exposed, since the key is public in the configuration. Anyone running a patched version with a changed key, or not running this admin system, can skip it. unknown for whether the key is exposed in other forms.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adminpanel","apevoloadmin","critical","other","selfhosted"],"first_public_at":"2026-11-02T15:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120442","severity":null,"published_at":"2026-11-02T15:17:26+00:00","modified_at":"2026-11-02T15:17:26+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","fetched_at":"2026-11-02T15:24:02+00:00","note":null}],"documents":[{"id":52474,"url":"https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52475,"url":"https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":52476,"url":"https://www.vulncheck.com/advisories/ape-volo-admin-before-3.6.1-hardcoded-jwt-signing-key-authentication-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}