Authentication Bypass in INDOTALENT WHMS by Asp.Net-Core-Inventory-Order-Management-System

CVE-2026-125383

What is CVE-2026-125383?

The INDOTALENT WHMS application is susceptible to an authentication bypass due to a flawed implementation involving a hard-coded JWT signing key found in the appsettings.json file. This security lapse allows unauthenticated remote attackers to craft fraudulent tokens, granting them unauthorized access to the API and enabling them to impersonate any user role, including administrative privileges. Organizations relying on the affected versions should prioritize upgrading to mitigate this significant risk.

References