Authentication Bypass in Simple Admin Core Up to Version 1.8.7

CVE-2026-111690

What is CVE-2026-111690?

Simple Admin Core versions up to 1.8.7 are affected by an authentication bypass vulnerability, which enables unauthenticated attackers to forge super administrator tokens. By exploiting a hard-coded secret in the application, attackers can sign a JSON Web Token (JWT) granting them full administrative control over user management, roles, menus, API authorities, configurations, and tokens. This critical vulnerability poses significant risks to system integrity and data security.

References