BotSharp through version 5.2.0 ships with a hard-coded JWT signing key, which lets unauthenticated remote attackers forge bearer tokens and impersonate any known user, including administrators.
What Is It
CVE-2026-108860 is an authentication bypass in SciSharp's BotSharp. The Jwt:Key value is hard-coded in the WebStarter appsettings.json file. That HMAC secret is committed to the public repository, and the token issuer and audience are both fixed to botsharp. As a result, attackers can sign their own tokens that the application accepts as valid.
The weakness is classified as CWE-321 (Use of Hard-coded Cryptographic Key). VulnCheck reported the issue, and NVD published it on 2026-10-11. The NVD record status is currently "Received."
Why It Matters
A forged token lets an attacker impersonate any known user, including administrators, on API routes protected by Authorize. The attacker needs no credentials and no user interaction.
Severity is rated CRITICAL:
- CVSS 3.1: 9.1 (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The attack works over the network with low complexity and has high impact on confidentiality and integrity. - CVSS 4.0: 9.3 (VulnCheck, secondary score).
The supplied data has no CISA KEV entry for this CVE. Active exploitation is not confirmed by KEV at this time.
What's Vulnerable
- Vendor: SciSharp
- Product: BotSharp
- Affected versions: all versions up to and including 5.2.0
- Repository: https://github.com/SciSharp/BotSharp
The vulnerable configuration is in src/WebStarter/appsettings.json. The JWT validation setup is in src/Infrastructure/BotSharp.OpenAPI/BotSharpOpenApiExtensions.cs. Both are linked in the NVD references.
Patch Status
The supplied NVD data lists no fixed version, and there is no CISA KEV required action. The affected range is described only as "through 5.2.0." Check the vendor repository and the VulnCheck advisory for remediation updates.
The vulnerable key is committed to the public repository. Any deployment that still uses the default Jwt:Key from appsettings.json should be treated as exposed.