Authentication Bypass Vulnerability in Ape Volo Admin Product by Xianhc

CVE-2026-120442

What is CVE-2026-120442?

The vulnerability found in ape-volo-admin prior to version 3.6.1 allows unauthenticated attackers to exploit a hardcoded JWT signing key present in appsettings.json. By manipulating the jti claim to match the seeded administrator ID, attackers can forge administrator tokens, providing them with unauthorized access to the system's APIs. This breach can potentially compromise users, roles, permissions, and sensitive data within the application.

References