Authentication Bypass in BotSharp by SciSharp

CVE-2026-108860

What is CVE-2026-108860?

BotSharp versions up to 5.2.0 are susceptible to an authentication bypass vulnerability. This issue allows unauthenticated remote attackers to forge bearer tokens by exploiting a hard-coded Jwt:Key found in the appsettings.json file of the WebStarter application. As a result, attackers can sign tokens using the exposed HMAC secret and the hardcoded issuer and audience of BotSharp, facilitating impersonation of legitimate users, including those with administrative privileges, on Authorize-protected API endpoints. This vulnerability underscores the importance of safeguarding sensitive configuration data and implementing secure authentication mechanisms.

References