CVE-2026-111633 Details
Description
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.
An authentication bypass vulnerability has been identified in ZKEACMS versions through 4.4. This vulnerability allows unauthenticated attackers to forge JSON Web Tokens (JWTs) for the REST API by using a hard-coded HMAC-SHA256 signing key. The key is publicly accessible in the source code, enabling attackers to create tokens that impersonate an administrator. Once the token is forged, it can be used to access protected API endpoints, allowing modification of articles and products, as well as reading form submissions.
Replace the hard-coded signing key with a secure, randomly generated key that is stored outside the application code. Update the authentication configuration to use this new key, and invalidate any tokens signed with the old key.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/SeriaWei/ZKEACMS/issues/531 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://hackmd.io/@hieuPenguinnn/zkeacms-hardcoded-jwt-signing-key-admin-auth-bypass | CISA-ADP | ExploitRemedyTechnical Analysis |
| https://github.com/SeriaWei/ZKEACMS/blob/v4.4/src/ZKEACMS/Api/JwtBearerDefaults.cs#L14-L19 | [email protected] | Source CodeVendor |
| https://github.com/SeriaWei/ZKEACMS/blob/v4.4/src/ZKEACMS/BuilderAuthentication.cs#L41-L52 | [email protected] | Source CodeVendor |
| https://github.com/SeriaWei/ZKEACMS/issues/531 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://hackmd.io/@hieuPenguinnn/zkeacms-hardcoded-jwt-signing-key-admin-auth-bypass | [email protected] | ExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/zkeacms-through-4.4-authentication-bypass-via-hard-coded-jwt-signing-key | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-321 | Use of Hard-coded Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ZKEACMS | <= 4.4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |