VulnSocial

CVE-2026-111690

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-321

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-18: 110-18
Referenced assets1 URL
By indicator
Full discourse1 post
  • The Hacker Wire@TheHackerWire

    🚨 CVE-2026-111690 (CVSS 9.3 Critical) Hardcoded JWT secret in Simple Admin Core allows unauthenticated remote attackers to forge superadministrator tokens with roleId 001 and gain full administrative control over all APIs and users. https://www.thehackerwire.com/vulnerability/CVE-2026-111690/ https://t.co/EWJm0shHGm

    0001060
    190 followersView on X

Explore more

Back to dashboard