INDOTALENT - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/indotalent/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 04:01:51 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgINDOTALENT Asp.Net-Core-Inventory-Order-Management-System authentication bypass (CVE-2026-125383)https://feed.craftedsignal.io/briefs/2026-11-indotalent-whms-auth-bypass/Tue, 10 Nov 2026 04:01:51 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-indotalent-whms-auth-bypass/INDOTALENT WHMS versions before 10.20261109 contain an authentication bypass vulnerability via hard-coded JWT secrets in appsettings.json, allowing remote unauthenticated attackers to forge administrative tokens.INDOTALENT Asp.Net-Core-Inventory-Order-Management-System versions prior to 10.20261109 are vulnerable to authentication bypass due to the presence of hard-coded JWT signing keys, issuer, and audience strings within the 'appsettings.json' configuration file. An unauthenticated remote attacker can leverage these hard-coded values to generate valid, signed JWTs for any user account, including those with administrative privileges, to gain full control over the API.

Impact

Successful exploitation results in full unauthenticated administrative access to the API and the underlying inventory and order management data.

Recommendation

  • Upgrade INDOTALENT Asp.Net-Core-Inventory-Order-Management-System to version 10.20261109 or later immediately.
  • Review the contents of 'appsettings.json' in existing deployments to identify if hard-coded signing keys are present, especially if an immediate upgrade is not feasible.
  • Rotate all JWT signing keys if the application has been exposed to the internet.
]]>criticaladvisory