Summary
generated automatically from NVD dataape-volo-admin versions before 3.6.1 ship with a hardcoded JWT signing key in appsettings.json, which lets unauthenticated attackers forge administrator tokens. By signing a token offline with the jti claim set to the seeded administrator id, an attacker can gain full API control over users, roles, permissions and data. The flaw is classified as CWE-1394 and carries a CVSS v3.1 score of 9.8 (CRITICAL).
NVD description
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.
In-depth analysis on cveo.tech
This CVE is covered in an article: context, affected versions and published fixes.
CVSS v3.1 Score
Information
- Published
- 2 nov. 2026
- Updated
- 2 nov. 2026
- Status
- Received
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
References (8)
Similar CVEs
Other vulnerabilities of type CWE-1394
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.