ape-volo-admin <= 3.5.2 - Authentication Bypass via Hardcoded JWT Signing Key

ape-volo-admin 3.6.1 contains an authentication bypass caused by a hardcoded JWT signing key in appsettings.json, letting unauthenticated attackers forge administrator tokens and gain full API control, exploit requires knowledge of the hardcoded key. id: CVE-2026-120442 info: name: ape-volo-admin...