CVE-2026-111690 Details

A vulnerability in Simple Admin Core versions through 1.8.7 allows unauthenticated attackers to bypass authentication by forging super administrator tokens. This is achieved using the hard-coded Auth.AccessSecret found in the default configuration file. Attackers can sign a JSON Web Token (JWT) with the public secret and the roleId claim set to '001', granting them full administrative control over users, roles, menus, API authorities, configuration, and tokens. The vulnerability arises because the application trusts the token's claims without proper verification, allowing unauthorized access to sensitive administrative functions.

Replace the hard-coded AccessSecret in the default configuration with a placeholder that requires operators to set a strong, unique value before deployment. Additionally, implement a startup check to ensure the AccessSecret is not empty, too short, or set to a default sample value. As a defense in depth measure, avoid relying solely on the role claim for authorization; instead, verify roles against a trusted user store or use server-side sessions.