Cyber & AI intelligence
Wasteland.
Briefs indexed3476
Issues33
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-111690 2026-10-16

Simple Admin Core Hard-Coded JWT Secret Allows Unauthenticated Super Admin Takeover (CVE-2026-111690)

"Simple Admin Core through version 1.8.7 ships with a hard-coded JWT signing secret. According to VulnCheck's advisory, an unauthenticated attacker could use it to forge super administrator tokens and take control of the…"

Simple Admin Core through version 1.8.7 ships with a hard-coded JWT signing secret. According to VulnCheck's advisory, an unauthenticated attacker could use it to forge super administrator tokens and take control of the application on any deployment that still uses the default secret.

What Is It

CVE-2026-111690 is an authentication bypass in Simple Admin Core, an open-source project maintained by suyuan32. The Auth.AccessSecret value in api/etc/core.yaml is hard-coded and publicly visible in the project's repository. VulnCheck reports that an attacker can sign a JWT with this known secret and set the roleId claim to 001 to produce a token the application accepts as a super administrator. The weakness is classified as CWE-321, Use of Hard-coded Cryptographic Key. VulnCheck disclosed the issue, and NVD published it on October 16, 2026.

Why It Matters

VulnCheck says a forged token would give an attacker administrative control over users, roles, menus, API authorities, configuration and tokens. The attack requires no credentials and no user interaction. The secret is published in the project's source, so any deployment that has not replaced the default value and whose API is reachable is likely exposed. Deployments that set their own Auth.AccessSecret should not be affected by this specific attack path, although the supplied records do not confirm this.

VulnCheck rates it CRITICAL under both scoring systems:

Exploitation status: The supplied CISA KEV data contains no entry for this CVE, so CISA has not confirmed active exploitation. The CVSS 4.0 exploit maturity field is "Not Defined." A third-party technical writeup is publicly available on HackMD.

What's Vulnerable

NVD lists no CPE entries for this CVE yet. Its NVD status is "Deferred."

Patch Status

The supplied records do not name a fixed release. NVD links to pull request #382 in the simple-admin-core repository, but the data does not say whether that change is merged or which version will include it. Because there is no KEV entry, CISA has set no required action or due date.

Deployments running 1.8.7 or earlier should be treated as potentially exposed until operators confirm otherwise. Operators should check the referenced pull request and the VulnCheck advisory for remediation guidance. They should also confirm whether their deployment still uses the default Auth.AccessSecret from api/etc/core.yaml.

Sources