CVE-2026-120201

Summary

Jpom versions 2.10.0 through 2.11.12 contain an authentication bypass in the JPOM-USER-TOKEN header due to improper input validation, allowing unauthenticated attackers to inject Hutool Condition syntax (e.g., 'is not null') to impersonate a super-administrator and execute arbitrary commands.

Exploitability

Exploitation is trivial for remote attackers with network access; no authentication or user interaction is required.

Blast radius

Successful exploitation grants full administrative control, enabling complete compromise of confidentiality, integrity, and availability of the affected system.

Detection

Look for HTTP requests containing a JPOM-USER-TOKEN header with non-standard Hutool Condition syntax (e.g., 'is not null', 'is null') or unexpected boolean operators; such headers should normally contain only valid user identifiers or tokens, not executable condition expressions.

Prioritized remediation

Upgrade to Jpom version 2.11.13 or later, which patches the authentication bypass in the JPOM-USER-TOKEN header validation logic.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.