CVE-2026-120442

ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain fu...

CVE-2026-120442

The ape-volo-admin software (versions before 3.6.1 ) is vulnerable to an authentication bypass due to a hardcoded JWT signing key located in the appsettings.json file. This flaw allows unauthenticated attackers to sign tokens offline. By setting the jti claim to the seeded administrator ID, attac...

EUVD-2026-115202

ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain fu...