Description
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dromara | Jpom | 2.10.0 – ≤ 2.11.12 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Jpom 2.10.0-2.11.12 - Authentication Bypass http/cves/2026/CVE-2026-120201.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- GitHub Issue #121 issue-tracking
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/common/interceptor/LoginInterceptor.java#L146 technical-description
- https://github.com/dromara/Jpom product
- VulnCheck Advisory: Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header third-party-advisory