CVE-2026-120442— ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass

Quick assessment

Affected

xianhc ape-volo-admin

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ape-volo-admin 3.6.1 之前的版本存在身份验证绕过漏洞。由于 appsettings.json 中硬编码了 JWT 签名密钥，未认证的攻击者可以利用该密钥伪造管理员令牌。攻击者可在离线环境中签署令牌，并将 jti 声明设置为已预置的管理员 ID，从而获得对系统用户、角色、权限及数据的完整 API 控制权。

CVSS 9.8 · Critical EPSS 0.48% · P42 Updated Nov 02, 2026

Possible ATT&CK Techniques 2 AI

T1552 · Unsecured Credentials T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
xianhc	ape-volo-admin	`< 3.6.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass

Source: CVE Program / CVE List V5

Vulnerability Description

ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1394

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
xianhc	ape-volo-admin	0 ~ 3.6.1	-

II. Public POCs for CVE-2026-120442

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120442

请登录查看更多情报信息。

Other References for CVE-2026-120442 (8)

https://hackmd.io/@hieuPenguinnn/ape-volo-admin-hardcoded-jwt-secret-admin-token-forgery technical-description
https://github.com/xianhc/ape-volo-admin/issues/36 issue-tracking
https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Api/appsettings.json#L4-L10 technical-description
https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933 patch
https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Extensions/AuthorizationExtensions.cs#L50-L60 technical-description
https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Authentication/PermissionHandler.cs#L130-L172 technical-description
https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1 release-notes
https://www.vulncheck.com/advisories/ape-volo-admin-before-3.6.1-hardcoded-jwt-signing-key-authentication-bypass third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120442

IV. Related Vulnerabilities

Same weakness: CWE-1394