CVE-2026-108860 Details
Description
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes.
A vulnerability allowing authentication bypass has been identified in BotSharp versions through 5.2.0. This issue arises from a hard-coded JSON Web Token (JWT) signing key in the WebStarter project's appsettings.json file. Unauthenticated remote attackers can exploit this vulnerability by forging bearer tokens. They can sign these tokens using the exposed HMAC secret, along with the fixed issuer and audience values, to impersonate any user, including administrators, on API routes protected by authorization.
Remove the hard-coded JWT signing key from the source code and require it to be set from a non-source configuration provider. Ensure that the application fails to start if the key is missing or set to a known placeholder value.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-321 | Use of Hard-coded Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SciSharp BotSharp | <= 5.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |