{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/indotalent/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:indotalent:asp.net-core-inventory-order-management-system:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-125383"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Asp.Net-Core-Inventory-Order-Management-System (\u003c 10.20261109)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["INDOTALENT"],"content_html":"\u003cp\u003eINDOTALENT Asp.Net-Core-Inventory-Order-Management-System versions prior to 10.20261109 are vulnerable to authentication bypass due to the presence of hard-coded JWT signing keys, issuer, and audience strings within the 'appsettings.json' configuration file. An unauthenticated remote attacker can leverage these hard-coded values to generate valid, signed JWTs for any user account, including those with administrative privileges, to gain full control over the API.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full unauthenticated administrative access to the API and the underlying inventory and order management data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade INDOTALENT Asp.Net-Core-Inventory-Order-Management-System to version 10.20261109 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview the contents of 'appsettings.json' in existing deployments to identify if hard-coded signing keys are present, especially if an immediate upgrade is not feasible.\u003c/li\u003e\n\u003cli\u003eRotate all JWT signing keys if the application has been exposed to the internet.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T04:01:51Z","date_published":"2026-11-10T04:01:51Z","id":"https://feed.craftedsignal.io/briefs/2026-11-indotalent-whms-auth-bypass/","summary":"INDOTALENT WHMS versions before 10.20261109 contain an authentication bypass vulnerability via hard-coded JWT secrets in appsettings.json, allowing remote unauthenticated attackers to forge administrative tokens.","title":"INDOTALENT Asp.Net-Core-Inventory-Order-Management-System authentication bypass (CVE-2026-125383)","url":"https://feed.craftedsignal.io/briefs/2026-11-indotalent-whms-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - INDOTALENT","version":"https://jsonfeed.org/version/1.1"}