Authentication Bypass in Jpom by Dromara Affects Multiple Versions

CVE-2026-120201

What is CVE-2026-120201?

An authentication bypass vulnerability exists in Jpom versions 2.10.0 through 2.11.12, allowing attackers to gain super-administrator access. By manipulating the JPOM-USER-TOKEN header and injecting query conditions such as 'is not null', unauthorized users can exploit Hutool's Condition parser to execute commands via Jpom's script features. This flaw emphasizes the critical need for enhanced security measures and prompt patching.

References