CVE-2026-108860

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience t...

CVE-2026-108860 BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience t...

CVE-2026-108860

BotSharp versions through 5.2.0 are vulnerable to an authentication bypass due to a hard-coded JWT signing key located in the WebStarter appsettings.json file. This flaw allows unauthenticated remote attackers to forge bearer tokens by using the committed HMAC secret, fixed issuer, and fixed audi...

CVE-2026-108860

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience t...

EUVD-2026-97011

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience t...

CVE-2026-108860 BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience t...

PT-2026-110179

Name of the Vulnerable Software and Affected Versions BotSharp versions prior to 5.2.1 Description An authentication bypass exists that allows unauthenticated remote attackers to forge bearer tokens. This is possible because the WebStarter appsettings.json file contains a hard-coded Jwt:Key...

CVE-2026-108860: Use of Hard-coded Cryptographic Key

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience t...