Vendor
An authentication bypass vulnerability in ape-volo-admin before version 3.6.1 allows unauthenticated attackers to forge administrative tokens using a hardcoded JWT signing key found in appsettings.json.