CVE-2026-110612

Summary

The vlife application contains a critical authentication bypass vulnerability due to a hardcoded HS256 signing key in TokenUtil, allowing attackers to forge JWT tokens with super administrator privileges and gain full access to any URL on affected instances.

Exploitability

The vulnerability is highly exploitable as it requires no authentication and allows attackers to easily forge valid JWT tokens with superUser=true claims, making exploitation straightforward with minimal preconditions.

Blast radius

The impact is significant as attackers can gain complete administrative access to vlife instances, potentially compromising all user data, system configurations, and enabling further lateral movement within the affected environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.0.2 or later to address the hardcoded JWT signing key vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.