Authentication Bypass in vlife via Hardcoded JWT Signing Key

vlife versions up to and including 2.0.1 contain a critical authentication bypass vulnerability (CVE-2026-110612). The vulnerability stems from the TokenUtil component, which utilizes a hardcoded HS256 signing key for JSON Web Token (JWT) generation. Because the secret key is embedded within the application source code or compiled binary, an unauthenticated attacker who gains access to the key can programmatically forge tokens. By crafting a JWT with the 'superUser' claim set to true and arbitrary 'groupIds', an attacker can impersonate any user, including high-privilege system administrators, to gain full control over the affected vlife instance. This flaw enables complete unauthorized access to all application URLs and functionalities.

Impact

Successful exploitation results in full administrative takeover of the vlife platform. This bypass allows an unauthenticated actor to perform any action available to a super administrator, including data exfiltration, configuration modification, and account management. The severity is reflected in a CVSS v3.1 base score of 9.8.

Recommendation

• Immediately upgrade vlife to a version beyond 2.0.1 that removes the hardcoded signing key.
• Audit access logs for any anomalous JWTs or authentication claims that appear outside of the established identity provider flow.
• Implement strict network perimeter controls to restrict access to administrative endpoints if patching cannot be performed immediately.