Hardcoded JWT signing key in ape-volo-admin allows admin token forgery
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
ape-volo-admin before 3.6.1 uses a hardcoded JWT signing key in appsettings.json, which lets unauthenticated attackers forge administrator tokens. An attacker who knows the key can sign tokens offline with the jti claim set to the seeded administrator id, gaining full API control over users, roles, permissions and data. The flaw is classified as CWE-1394, Use of Default Cryptographic Key.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade ape-volo-admin to version 3.6.1 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA ape-volo-admin (xianhc) Fixed in 3.6.1
Timeline
- 2026-11-02 Threatist record created from CVE-2026-120442
- 2026-11-02 Alias added: GHSA-c4wp-cj2h-5rj2
- 2026-11-05 CISA SSVC decision points changed
- 2026-11-06 EPSS moved to the 50th–90th percentile
References
Other 6
- https://github.com/xianhc/ape-volo-admin/issues/36
- ape-volo-admin V3.6.1 Release Notes
- https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Api/appsettings.json#L4-L10
- https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Extensions/AuthorizationExtensions.cs#L50-L60
- https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Authentication/PermissionHandler.cs#L130-L172
- https://hackmd.io/@hieuPenguinnn/ape-volo-admin-hardcoded-jwt-secret-admin-token-forgery
Sources
- CVE-2026-120442 · CVE Program
- CVE-2026-120442 · NVD
- FIRST EPSS
- GHSA-c4wp-cj2h-5rj2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences