CVE-2026-120442

The ape-volo-admin software (versions before 3.6.1 ) is vulnerable to an authentication bypass due to a hardcoded JWT signing key located in the appsettings.json file. This flaw allows unauthenticated attackers to sign tokens offline. By setting the jti claim to the seeded administrator ID, attac...