---
id: "CVE-2026-120442"
kind: "vulnerability"
aliases: ["CVE-2026-120442"]
title: "ape-volo-admin: hardcoded JWT key lets attackers forge admin tokens"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["admin-panel", "ape-volo-admin", "other", "self-hosted"]
not_affected_if: ["changed-jwt-key", "version-3.6.1-or-later"]
published_at: "2026-11-02T15:17:26+00:00"
first_seen_at: "2026-11-02T15:24:02+00:00"
updated_at: "2026-11-02T15:25:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120442", "first_seen_at": "2026-11-02T15:24:02+00:00"}]
---

# ape-volo-admin: hardcoded JWT key lets attackers forge admin tokens

ape-volo-admin ships a JWT signing key hardcoded in appsettings.json, so anyone who reads that file can sign tokens offline. A forged token with the seeded administrator id gives full API control over users, roles, permissions and data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployed `appsettings.json` contains a hardcoded JWT signing key
- Check the installed ape-volo-admin version is below `3.6.1`

## Fix

- ape-volo-admin: move to `3.6.1` or later

## Timeline

- 2026-11-02T15:24:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120442

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ape-volo-admin-before-3.6.1-hardcoded-jwt-signing-key-authentication-bypass
- [fix] Patch: github.com https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933
- [fix] Release notes: github.com https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1

## From the sources

ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_