Product

ZKEACMS (<= 4.4)

1 brief RSS

Authentication Bypass in ZKEACMS via JWT Forgery

ZKEACMS versions through 4.4 contain a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs, allowing unauthenticated attackers to forge JWT bearer tokens and bypass authentication.

ZKEACMS web-application authentication-bypass jwt cve-2026-111633

1t 1c 1h ago