{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/vlife--2.0.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vlife:vlife:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-110612"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["vlife (\u003c= 2.0.1)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["vlife"],"content_html":"\u003cp\u003evlife versions up to and including 2.0.1 contain a critical authentication bypass vulnerability (CVE-2026-110612). The vulnerability stems from the TokenUtil component, which utilizes a hardcoded HS256 signing key for JSON Web Token (JWT) generation. Because the secret key is embedded within the application source code or compiled binary, an unauthenticated attacker who gains access to the key can programmatically forge tokens. By crafting a JWT with the 'superUser' claim set to true and arbitrary 'groupIds', an attacker can impersonate any user, including high-privilege system administrators, to gain full control over the affected vlife instance. This flaw enables complete unauthorized access to all application URLs and functionalities.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative takeover of the vlife platform. This bypass allows an unauthenticated actor to perform any action available to a super administrator, including data exfiltration, configuration modification, and account management. The severity is reflected in a CVSS v3.1 base score of 9.8.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade vlife to a version beyond 2.0.1 that removes the hardcoded signing key.\u003c/li\u003e\n\u003cli\u003eAudit access logs for any anomalous JWTs or authentication claims that appear outside of the established identity provider flow.\u003c/li\u003e\n\u003cli\u003eImplement strict network perimeter controls to restrict access to administrative endpoints if patching cannot be performed immediately.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:32:48Z","date_published":"2026-10-14T16:32:48Z","id":"https://feed.craftedsignal.io/briefs/2026-10-vlife-auth-bypass/","summary":"The vlife application through version 2.0.1 contains a hardcoded HS256 JWT signing key in TokenUtil, allowing unauthenticated attackers to forge tokens and gain administrative privileges.","title":"Authentication Bypass in vlife via Hardcoded JWT Signing Key","url":"https://feed.craftedsignal.io/briefs/2026-10-vlife-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Vlife (\u003c= 2.0.1)","version":"https://jsonfeed.org/version/1.1"}