{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-111633/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zkeacms:zkeacms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-111633"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ZKEACMS (\u003c= 4.4)"],"_cs_severities":["high"],"_cs_tags":["web-application","authentication-bypass","jwt","cve-2026-111633"],"_cs_type":"advisory","_cs_vendors":["ZKEACMS"],"content_html":"\u003cp\u003eZKEACMS versions up to 4.4 contain a critical security vulnerability involving a hard-coded HMAC-SHA256 signing key located within the JwtBearerDefaults.cs file. This flaw allows unauthenticated remote attackers to generate and sign their own JWT bearer tokens. By crafting a token with the 'Name' claim set to 'admin', an attacker can successfully bypass authentication controls when interacting with the application's REST API. Successful exploitation provides administrative-level access to the ApiAuthorize endpoints, which are protected by the JWT authentication mechanism. This access allows an attacker to perform unauthorized actions including the modification of articles and product listings, as well as the unauthorized extraction of user form submissions stored within the system. Given the nature of the hard-coded key, any instance of ZKEACMS up to version 4.4 is vulnerable if the application utilizes the default JWT authentication configuration.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe exploitation of CVE-2026-111633 results in full authentication bypass and unauthorized administrative access to the ZKEACMS REST API. Impacted sectors include organizations using ZKEACMS for content management and e-commerce platforms. Successful exploitation allows for the compromise of site integrity through the unauthorized modification of content and products, as well as the compromise of data privacy through the exfiltration of sensitive form submissions. The ease of exploitation via the static hard-coded key poses a significant risk to the availability, integrity, and confidentiality of the targeted application data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all ZKEACMS instances to a version later than 4.4 that remediates the use of hard-coded cryptographic keys.\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not possible, disable the REST API or implement network-level access controls to restrict access to ApiAuthorize endpoints to trusted internal IP ranges.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for high volumes of API requests containing JWT tokens that deviate from standard issued tokens or show unusual administrative activity from unrecognized sources.\u003c/li\u003e\n\u003cli\u003ePerform an integrity check on articles and product data to identify any unauthorized modifications potentially performed via the compromised API.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-16T18:47:12Z","date_published":"2026-10-16T18:47:12Z","id":"https://feed.craftedsignal.io/briefs/2026-10-zkeacms-auth-bypass/","summary":"ZKEACMS versions through 4.4 contain a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs, allowing unauthenticated attackers to forge JWT bearer tokens and bypass authentication.","title":"Authentication Bypass in ZKEACMS via JWT Forgery","url":"https://feed.craftedsignal.io/briefs/2026-10-zkeacms-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-111633","version":"https://jsonfeed.org/version/1.1"}