Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🆕 New CVE xianhc ape-volo-admin: auth bypass via hardcoded JWT signing key (CVE-2026-120442) An unauthenticated attacker can forge administrator tokens and gain full control over users, roles, and data. Patch → 3.6.1 https://cve.now/CVE-2026-120442?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
⚠️ CVE-2026-120442 (9.8) ⚠️ ape-volo-admin lets anyone forge an administrator login token and take full control of the API, including users, roles, permissions and data. ape-volo-admin before 3.6.1 is affected. Upgrade to 3.6.1 or later. https://t.co/j8Acr0TOq1
CVE-2026-120442 (CVSS 9.8): authentication bypass in ape-volo-admin before 3.6.1. A hardcoded JWT signing key in appsettings.json lets unauthenticated attackers forge admin tokens offline and take full API control. Upgrade to 3.6.1. Source: NVD