INDOTALENT Asp.Net-Core-Inventory-Order-Management-System authentication bypass (CVE-2026-125383)
INDOTALENT WHMS versions before 10.20261109 contain an authentication bypass vulnerability via hard-coded JWT secrets in appsettings.json, allowing remote unauthenticated attackers to forge administrative tokens.
CVE search metadata
CVE search record: CVE-2026-125383. Severity: critical. CVSS: 9.8. KEV: no. Product: Asp.Net-Core-Inventory-Order-Management-System (< 10.20261109). Brief: INDOTALENT Asp.Net-Core-Inventory-Order-Management-System authentication bypass (CVE-2026-125383). Brief link: https://feed.craftedsignal.io/briefs/2026-11-indotalent-whms-auth-bypass/
Triage facts
Revision 1- Applicability
- Asp.Net-Core-Inventory-Order-Management-System (< 10.20261109)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Nov 10, 04:01 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
INDOTALENT Asp.Net-Core-Inventory-Order-Management-System versions prior to 10.20261109 are vulnerable to authentication bypass due to the presence of hard-coded JWT signing keys, issuer, and audience strings within the 'appsettings.json' configuration file. An unauthenticated remote attacker can leverage these hard-coded values to generate valid, signed JWTs for any user account, including those with administrative privileges, to gain full control over the API.
Impact
Successful exploitation results in full unauthenticated administrative access to the API and the underlying inventory and order management data.
Recommendation
- Upgrade INDOTALENT Asp.Net-Core-Inventory-Order-Management-System to version 10.20261109 or later immediately.
- Review the contents of 'appsettings.json' in existing deployments to identify if hard-coded signing keys are present, especially if an immediate upgrade is not feasible.
- Rotate all JWT signing keys if the application has been exposed to the internet.
Immediate actions
Upgrade Asp.Net-Core-Inventory-Order-Management-System to 10.20261109
Threat Hunt
Inspect access logs for anomalous authentication patterns or administrative API calls originating from non-administrative IP addresses.
Data: Web server access logs, Application API logs
Mitigations
Upgrade to 10.20261109 or rotate hard-coded keys in appsettings.json
CVE-2026-125383