ape-volo-admin: Authentication bypass via hardcoded JWT signing key (CVE-2026-120442)

The ape-volo-admin application prior to version 3.6.1 is vulnerable to an authentication bypass. The software uses a hardcoded JWT signing key stored in the 'appsettings.json' configuration file. An attacker with access to this file, or knowledge of the key, can perform offline token forging. By signing a JWT with the 'jti' claim set to a known administrator ID, an attacker can gain unauthorized administrative access to the API, including control over users, roles, permissions, and data.

Impact

Successful exploitation allows unauthenticated attackers to gain full administrative privileges over the ape-volo-admin instance, enabling complete control over user management, data access, and system configuration.

Recommendation

• Upgrade to ape-volo-admin version 3.6.1 or later immediately.
• Review and rotate the JWT signing key defined in 'appsettings.json' if it is suspected that the configuration file has been exposed or accessed by unauthorized parties.
• Audit API access logs for anomalous administrative actions or token usage patterns originating from unexpected sources.