vlife Authentication Bypass via Hardcoded JWT Signing Key in TokenUtil
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321.
Summary
vlife through 2.0.1 contains an authentication bypass in TokenUtil. The code uses a hardcoded HS256 signing key, which is CWE-321 (use of hard-coded cryptographic key). An unauthenticated remote attacker can forge a JWT signed with that key, set superUser to true and add arbitrary groupIds claims, and gain super administrator access to any URL on vlife instances.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for vlife.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-14 Threatist record created from CVE-2026-110612
- 2026-10-14 Alias added: GHSA-v9cf-gm8v-mp4m
- 2026-10-15 CISA SSVC decision points changed
- 2026-10-15 Priority changed: MEDIUM → HIGH
References
Other 3
- https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653f5b0d9a70721734d6d/vlife-boot-starter-web/src/main/java/cn/wwwlike/web/security/filter/TokenUtil.java#L33-L58
- https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653f5b0d9a70721734d6d/vlife-base/src/main/java/cn/wwwlike/config/VlifeUrlDecisionManager.java#L25
- https://github.com/wwwlike/vlife
More wwwlike vulnerabilities
- TI-2025-12130 wwwlike vlife VLifeApi SysFileApi.java create path traversal CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-110612 · CVE Program
- CVE-2026-110612 · NVD
- FIRST EPSS
- GHSA-v9cf-gm8v-mp4m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences