CVE-2026-110612

The vlife application (versions through 2.0.1 ) is vulnerable to an authentication bypass due to a hardcoded HS256 signing key located in the TokenUtil component. This flaw allows unauthenticated attackers to forge JWTs by injecting superUser=true and arbitrary groupIds claims, granting them supe...