{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-111690/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:simpleadmin:simple_admin_core:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-111690"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Simple Admin Core (\u003c= 1.8.7)"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","jwt","cve-2026-111690","administrative-takeover"],"_cs_type":"advisory","_cs_vendors":["Simple Admin"],"content_html":"\u003cp\u003eSimple Admin Core versions 1.8.7 and earlier contain a critical security vulnerability (CVE-2026-111690) that enables unauthenticated attackers to perform a full authentication bypass. The vulnerability stems from the use of a hard-coded value for the 'Auth.AccessSecret' setting found in the 'api/etc/core.yaml' configuration file.\u003c/p\u003e\n\u003cp\u003eBy obtaining this hard-coded secret, which is a known constant in default installations, an attacker can construct and sign JSON Web Tokens (JWTs). By including a 'roleId' claim set to '001', the attacker can successfully impersonate a super administrator. This grants the attacker unrestricted access to sensitive application functions, including user account management, role assignment, menu modification, API authority configuration, and the ability to generate or manipulate further authentication tokens. This vulnerability represents a total compromise of the application's access control mechanisms.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for complete administrative takeover of the Simple Admin Core application. An attacker can manipulate user accounts, modify system configurations, and intercept or create API authorities. Successful exploitation compromises the confidentiality, integrity, and availability of all data managed by the application, with a CVSS v3.1 base score of 9.8.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of Simple Admin Core running in the environment and verify their version.\u003c/li\u003e\n\u003cli\u003eUpgrade all Simple Admin Core instances to a version released after 1.8.7 where the hard-coded secret is removed or configurable via environment variables.\u003c/li\u003e\n\u003cli\u003eAudit the 'api/etc/core.yaml' file on existing servers to confirm if the default hard-coded secret is in use.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, rotate the secret in 'api/etc/core.yaml' to a unique, high-entropy value and restart the application services, noting that this may break existing legitimate sessions and require reconfiguration of any services relying on the previous secret.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:45:28Z","date_published":"2026-10-16T18:45:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-111690/","summary":"Simple Admin Core versions up to 1.8.7 contain a critical authentication bypass vulnerability allowing attackers to forge administrative JWTs using a hard-coded secret.","title":"Authentication Bypass in Simple Admin Core via Hard-coded Secret","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-111690/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-111690","version":"https://jsonfeed.org/version/1.1"}