CVE-2026-111633

The record

ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.

Affected packages

Related vulnerabilities

• CVE-2026-61737 ng-antd-admin is an Angular and NestJS administration system template. CWE-321
• CVE-2026-91912 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded… CWE-321
• CVE-2026-119597 OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that… CWE-321
• CVE-2025-62841 An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3… CWE-321
• CVE-2025-62839 An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3… CWE-321
• CVE-2026-86384 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024… CWE-321
• CVE-2026-102812 A hard-coded cryptographic key vulnerability exists in the user-configuration backup… CWE-321
• CVE-2026-117564 nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows… CWE-321