ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Affected Vendors & Products

Vendors Products
Xianhc
  • Ape-volo-admin

No data.

No data.

References
Link Providers
https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Api/appsettings.json#L4-L10 cve-icon cve-icon
https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Authentication/PermissionHandler.cs#L130-L172 cve-icon cve-icon
https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Extensions/AuthorizationExtensions.cs#L50-L60 cve-icon cve-icon
https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933 cve-icon cve-icon
https://github.com/xianhc/ape-volo-admin/issues/36 cve-icon cve-icon
https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1 cve-icon cve-icon
https://hackmd.io/@hieuPenguinnn/ape-volo-admin-hardcoded-jwt-secret-admin-token-forgery cve-icon cve-icon
https://www.vulncheck.com/advisories/ape-volo-admin-before-3.6.1-hardcoded-jwt-signing-key-authentication-bypass cve-icon cve-icon
History

Fri, 06 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 03 Nov 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Xianhc
Xianhc ape-volo-admin
Vendors & Products Xianhc
Xianhc ape-volo-admin

Mon, 02 Nov 2026 14:30:00 +0000

Type Values Removed Values Added
Description ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.
Title ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass
Weaknesses CWE-1394
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-11-02T14:29:03.407Z

Updated: 2026-11-05T21:39:20.223Z

Reserved: 2026-11-02T12:42:16.749Z

Link: CVE-2026-120442

cve-icon Vulnrichment

Updated: 2026-11-05T21:39:13.260Z

cve-icon NVD

Status : Deferred

Published: 2026-11-02T15:17:26.490

Modified: 2026-11-05T22:17:54.267

Link: CVE-2026-120442

cve-icon Redhat

No data.