CVE-2026-125383

Summary

The INDOTALENT WHMS application uses a hard-coded JWT signing key, issuer, and audience in its appsettings.json file, allowing unauthenticated attackers to forge valid authentication tokens for any user role, including administrator. This authentication bypass enables full API access without credentials.

Exploitability

Exploitation is trivial for remote attackers with no prerequisites beyond network access to the API, as the signing key and token parameters are publicly embedded in configuration files.

Blast radius

Successful exploitation grants full administrative control over the entire API, enabling complete data exfiltration, system modification, or service disruption across all affected instances.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 10.20261109 or later, which removes the hard-coded JWT credentials and enforces secure key management.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.