CVE-2026-120442
Critical · 9.8CVSS
9.8
EPSS
0.5%
Published
Nov 2, 2026
CISA due date
—
The record
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119660 MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows… CWE-1394
- CVE-2026-54887 Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows… CWE-1394
- CVE-2026-5039 TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a… CWE-1394
- CVE-2026-20709 Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor… CWE-1394
- CVE-2026-2215 A vulnerability was detected in rachelos WeRSS we-mp-rss up to 1.4.8. CWE-1394
- CVE-2026-25815 Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in… CWE-1394
- CVE-2025-41742 Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an… CWE-1394
- CVE-2025-41744 Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an… CWE-1394