TI-2026-70750 CVE-2026-108860 · GHSA-w9f8-hvcg-hgcm
Hard-coded JWT signing key in BotSharp allows authentication bypass
Priority MEDIUM 49
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json.