{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aape-voloape-volo-admin/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ape-volo:ape-volo-admin:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-120442"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ape-volo-admin (\u003c 3.6.1)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["ape-volo"],"content_html":"\u003cp\u003eThe ape-volo-admin application prior to version 3.6.1 is vulnerable to an authentication bypass. The software uses a hardcoded JWT signing key stored in the 'appsettings.json' configuration file. An attacker with access to this file, or knowledge of the key, can perform offline token forging. By signing a JWT with the 'jti' claim set to a known administrator ID, an attacker can gain unauthorized administrative access to the API, including control over users, roles, permissions, and data.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to gain full administrative privileges over the ape-volo-admin instance, enabling complete control over user management, data access, and system configuration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to ape-volo-admin version 3.6.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview and rotate the JWT signing key defined in 'appsettings.json' if it is suspected that the configuration file has been exposed or accessed by unauthorized parties.\u003c/li\u003e\n\u003cli\u003eAudit API access logs for anomalous administrative actions or token usage patterns originating from unexpected sources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-02T15:47:26Z","date_published":"2026-11-02T15:47:26Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ape-volo-admin-auth-bypass/","summary":"An authentication bypass vulnerability in ape-volo-admin before version 3.6.1 allows unauthenticated attackers to forge administrative tokens using a hardcoded JWT signing key found in appsettings.json.","title":"ape-volo-admin: Authentication bypass via hardcoded JWT signing key (CVE-2026-120442)","url":"https://feed.craftedsignal.io/briefs/2026-11-ape-volo-admin-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:ape-Volo:ape-Volo-Admin:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}