CVE-2026-120442 Details
Description
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.
A vulnerability allowing authentication bypass has been identified in Ape Volo Admin versions prior to 3.6.1. This issue arises from a hardcoded JWT signing key in the application's configuration file, appsettings.json, which is publicly accessible in the source repository. The vulnerability allows unauthenticated attackers to forge administrator tokens by setting the token's jti claim to the seeded administrator ID. Once the token is forged, attackers can gain full control over the API, including management of users, roles, permissions, and access to sensitive data.
Users are advised to update to Ape Volo Admin version 3.6.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1394 | Use of Default Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ape-volo-admin | >= 0, < 3.6.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |