CVE-2026-110612 Details
Description
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.
A vulnerability in vlife version 2.0.1 allows unauthenticated attackers to bypass authentication by forging JSON Web Tokens (JWTs). This is possible due to a hardcoded signing key in the TokenUtil class, which uses the HMAC-SHA256 algorithm. Attackers can create tokens with elevated privileges, such as super administrator access, by manipulating the token claims. The vulnerability arises because the application trusts the token data without proper verification against server-side records, enabling unauthorized access to protected resources.
Replace the hardcoded JWT signing secret with a per-deployment secret loaded from external configuration. Implement a server-side verification process that re-checks user roles and privileges against the database, rather than trusting claims in the token. Additionally, consider using an asymmetric signing scheme for JWTs, allowing the verification key to be distributed without exposing the signing key.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-321 | Use of Hard-coded Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwwlike vlife | <= 2.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |