Cpe:2.3:a:ape-Volo:ape-Volo-Admin:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aape-voloape-volo-admin/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 15:47:26 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgape-volo-admin: Authentication bypass via hardcoded JWT signing key (CVE-2026-120442)https://feed.craftedsignal.io/briefs/2026-11-ape-volo-admin-auth-bypass/Mon, 02 Nov 2026 15:47:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ape-volo-admin-auth-bypass/An authentication bypass vulnerability in ape-volo-admin before version 3.6.1 allows unauthenticated attackers to forge administrative tokens using a hardcoded JWT signing key found in appsettings.json.The ape-volo-admin application prior to version 3.6.1 is vulnerable to an authentication bypass. The software uses a hardcoded JWT signing key stored in the 'appsettings.json' configuration file. An attacker with access to this file, or knowledge of the key, can perform offline token forging. By signing a JWT with the 'jti' claim set to a known administrator ID, an attacker can gain unauthorized administrative access to the API, including control over users, roles, permissions, and data.

Impact

Successful exploitation allows unauthenticated attackers to gain full administrative privileges over the ape-volo-admin instance, enabling complete control over user management, data access, and system configuration.

Recommendation

  • Upgrade to ape-volo-admin version 3.6.1 or later immediately.
  • Review and rotate the JWT signing key defined in 'appsettings.json' if it is suspected that the configuration file has been exposed or accessed by unauthorized parties.
  • Audit API access logs for anomalous administrative actions or token usage patterns originating from unexpected sources.
]]>criticaladvisory