EUVD-2026-97011

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience t...

CVE-2026-108860

BotSharp versions through 5.2.0 are vulnerable to an authentication bypass due to a hard-coded JWT signing key located in the WebStarter appsettings.json file. This flaw allows unauthenticated remote attackers to forge bearer tokens by using the committed HMAC secret, fixed issuer, and fixed audi...