ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass
ape-volo-admin versions before 3.6.1 are affected, and the original report named version 3.5.2. CVSS scores it 9.3 (critical). Fixed in 3.6.1.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 3.6.1
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 3.6.1.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 16/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 3.6.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The ape-volo-admin software, a web administration application, is affected by an authentication bypass caused by a hardcoded JWT signing key stored in its configuration file. An unauthenticated attacker could forge administrator tokens and gain full control over users, roles, permissions, and data through the API.
Read the original description
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.
What to do
Upgrade to a fixed version: 3.6.1.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- xianhc ape-volo-admin
fixed in 3.6.1
Evidence 8
- Patch
- Report
- Repository
- Repository
- Repository
Show all 8 sourcesShow fewer sources
- Repository
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120442
What does this mean?
The application signs its JWT login tokens with a signing key that is hardcoded in the code rather than kept secret per installation. Because the key is the same everywhere and is written into the code, it can be used to create tokens that the application accepts as valid, which is an authentication bypass.Source: github.com
Am I affected, and how do I check?
The advisory lists xianhc/ape-volo-admin versions before 3.6.1 as the affected range, and the original report cites version 3.5.2. To compare, check the installed version of ape-volo-admin in the project and see whether it is lower than 3.6.1.Source: github.com
What should I do about it?
Upgrade ape-volo-admin to version 3.6.1 or later, which is the listed fixed version.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data