Cve-2026-111633 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-111633/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 18:47:12 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthentication Bypass in ZKEACMS via JWT Forgeryhttps://feed.craftedsignal.io/briefs/2026-10-zkeacms-auth-bypass/Fri, 16 Oct 2026 18:47:12 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-zkeacms-auth-bypass/ZKEACMS versions through 4.4 contain a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs, allowing unauthenticated attackers to forge JWT bearer tokens and bypass authentication.ZKEACMS versions up to 4.4 contain a critical security vulnerability involving a hard-coded HMAC-SHA256 signing key located within the JwtBearerDefaults.cs file. This flaw allows unauthenticated remote attackers to generate and sign their own JWT bearer tokens. By crafting a token with the 'Name' claim set to 'admin', an attacker can successfully bypass authentication controls when interacting with the application's REST API. Successful exploitation provides administrative-level access to the ApiAuthorize endpoints, which are protected by the JWT authentication mechanism. This access allows an attacker to perform unauthorized actions including the modification of articles and product listings, as well as the unauthorized extraction of user form submissions stored within the system. Given the nature of the hard-coded key, any instance of ZKEACMS up to version 4.4 is vulnerable if the application utilizes the default JWT authentication configuration.

Impact

The exploitation of CVE-2026-111633 results in full authentication bypass and unauthorized administrative access to the ZKEACMS REST API. Impacted sectors include organizations using ZKEACMS for content management and e-commerce platforms. Successful exploitation allows for the compromise of site integrity through the unauthorized modification of content and products, as well as the compromise of data privacy through the exfiltration of sensitive form submissions. The ease of exploitation via the static hard-coded key poses a significant risk to the availability, integrity, and confidentiality of the targeted application data.

Recommendation

  1. Upgrade all ZKEACMS instances to a version later than 4.4 that remediates the use of hard-coded cryptographic keys.
  2. If an immediate upgrade is not possible, disable the REST API or implement network-level access controls to restrict access to ApiAuthorize endpoints to trusted internal IP ranges.
  3. Audit web server logs for high volumes of API requests containing JWT tokens that deviate from standard issued tokens or show unusual administrative activity from unrecognized sources.
  4. Perform an integrity check on articles and product data to identify any unauthorized modifications potentially performed via the compromised API.
]]>highadvisoryweb-applicationauthentication-bypassjwtcve-2026-111633