CVE-2026-120442

Summary

ape-volo-admin before 3.6.1 uses a hardcoded JWT signing key in appsettings.json, enabling unauthenticated attackers to forge valid administrator tokens offline by signing them with the known key and setting the jti claim to the seeded admin ID.

Exploitability

Trivial to exploit; requires only knowledge of the hardcoded key (publicly discoverable via source code or config exposure) and the target admin's jti value.

Blast radius

Full compromise of the application: attackers gain unrestricted API access to manage users, roles, permissions, and all data stored by the system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ape-volo-admin version 3.6.1 or later, which removes the hardcoded JWT signing key and implements secure key management.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.