Description
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| xianhc | ape-volo-admin | < 3.6.1 | 3.6.1 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- ape-volo-admin <= 3.5.2 - Authentication Bypass via Hardcoded JWT Signing Key http/cves/2026/CVE-2026-120442.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://github.com/xianhc/ape-volo-admin/issues/36 issue-tracking
- https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933 patch
- ape-volo-admin V3.6.1 Release Notes release-notes
- https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Api/appsettings.json#L4-L10 technical-description
- https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Extensions/AuthorizationExtensions.cs#L50-L60 technical-description
- https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Authentication/PermissionHandler.cs#L130-L172 technical-description
- https://hackmd.io/@hieuPenguinnn/ape-volo-admin-hardcoded-jwt-secret-admin-token-forgery technical-description
- VulnCheck Advisory: ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass third-party-advisory