CVE-2026-111690

Summary

The Simple Admin Core plugin contains a critical authentication bypass vulnerability due to a hard-coded secret key that allows attackers to forge administrator tokens and gain full administrative access. This flaw enables unauthorized users to completely compromise the system's user management, roles, menus, API permissions, configuration, and token systems.

Exploitability

The vulnerability is extremely easy to exploit with no prerequisites since attackers can directly sign JWT tokens using the hard-coded Auth.AccessSecret without needing any valid credentials or session data.

Blast radius

If exploited, this vulnerability could allow attackers to fully compromise all administrative functions including user accounts, role management, menu configurations, API access controls, system settings, and token generation capabilities across the affected system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Immediate remediation requires upgrading to version 1.8.8 or later which contains the fix for the authentication bypass vulnerability in Simple Admin Core.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.