CVE-2026-120201 is a critical (CVSS 3.1 9.8) authentication bypass in dromara Jpom: an unauthenticated attacker can inject query conditions through the JPOM-USER-TOKEN header, gain super-administrator access, and then run commands.
What Is It
The flaw affects Jpom versions 2.10.0 through 2.11.12. According to the NVD record, the attacker puts a query condition in the JPOM-USER-TOKEN header instead of a real token. A value such as is not null gets read by Hutool's Condition parser as an operator, not as a literal token string. That condition turns the token check into a match, so the attacker gets super-administrator access without credentials. They can then run commands through Jpom's script features.
The weakness is classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic). The CVE was published on 2026-10-31 by VulnCheck, and its NVD status is currently "Deferred."
Why It Matters
- CVSS 3.1: 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL (VulnCheck, secondary)
The attack works over the network, has low complexity, and needs no privileges or user interaction. One crafted header gets an attacker from no access to super-administrator. Because Jpom's script features can run commands, the bypass can lead to command execution on systems that Jpom manages. Confidentiality, integrity, and availability impacts are all rated High.
The supplied CISA KEV data has no entry for this CVE. The sources do not confirm active exploitation in the wild.
What's Vulnerable
- Vendor: dromara
- Product: Jpom (
pkg:maven/org.dromara.jpom/server) - Affected versions: 2.10.0 through 2.11.12, inclusive
- Default status for other versions: unaffected
The disclosure points to the login interceptor at modules/server/src/main/java/org/dromara/jpom/common/interceptor/LoginInterceptor.java (line 146 in v2.11.12) as the relevant code.
Patch Status
The supplied NVD and KEV data do not name a fixed version or official remediation. Since there is no KEV entry, there is no CISA-required action or due date either. The affected range ends at 2.11.12, but the source material does not confirm that a later release fixes the flaw. If you run Jpom 2.10.0–2.11.12, check the VulnCheck advisory and the upstream Jpom repository and issue tracker for fix guidance. Until you can confirm a fixed release, limit network access to Jpom server instances.