Hard-coded JWT signing key in BotSharp allows authentication bypass
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321.
Summary
SciSharp BotSharp through 5.2.0 ships a hard-coded HMAC signing key in the WebStarter appsettings.json file (CWE-321). An unauthenticated remote attacker can sign bearer tokens with that committed key and the fixed botsharp issuer and audience. The forged tokens impersonate any known user, including administrators, on Authorize-protected API routes.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for BotSharp.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108860
- 2026-10-11 Alias added: GHSA-w9f8-hvcg-hgcm
- 2026-10-15 CISA SSVC decision points changed
References
Other 3
- https://github.com/SciSharp/BotSharp/blob/a11ee0317cab5c619df1cb5d0c4fc39d1b6e30b4/src/WebStarter/appsettings.json#L16-L20
- https://github.com/SciSharp/BotSharp/blob/a11ee0317cab5c619df1cb5d0c4fc39d1b6e30b4/src/Infrastructure/BotSharp.OpenAPI/BotSharpOpenApiExtensions.cs#L46-L57
- https://github.com/SciSharp/BotSharp
Sources
- CVE-2026-108860 · CVE Program
- CVE-2026-108860 · NVD
- FIRST EPSS
- GHSA-w9f8-hvcg-hgcm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences