ape-volo-admin before 3.6.1 ships with a hardcoded JWT signing key. If a deployment still uses that default key and the default seeded administrator account, an unauthenticated attacker can forge administrator tokens and take full control of the application's API.
What Is It
CVE-2026-120442 is an authentication bypass in ape-volo-admin, a project maintained by xianhc. The JWT signing key is hardcoded in the application's appsettings.json file. Anyone who knows that key can sign tokens offline. If the token's jti claim is set to the ID of the seeded administrator account, the application accepts it as that administrator.
The attack only works on instances where operators never replaced the shipped signing key and where the seeded administrator account still has its default ID. Deployments that set a unique signing key in configuration should not accept tokens signed with the published default.
VulnCheck reported the issue, and the record lists it under CWE-1394. The references point to the key in appsettings.json, plus PermissionHandler.cs and AuthorizationExtensions.cs at tag V3.5.2, as the code involved.
Why It Matters
On an exposed instance that still uses the defaults, a forged administrator token can give the attacker full API control over users, roles, permissions and data. The CVSS v3.1 vector shows how little the attack needs in that case:
- Attack vector: network
- Attack complexity: low
- Privileges required: none
- User interaction: none
- Impact: high on confidentiality, integrity and availability
The CVSS v3.1 base score is 9.8 (Critical). VulnCheck also gives a CVSS v4.0 score of 9.3 (Critical).
The default key is public in the project's repository, and tokens can be signed offline. Against a deployment that kept the shipped key, the attacker needs no credentials and no prior access to the target. How many real-world instances are exposed depends on how many operators left the default configuration in place, and that is not known.
Exploitation status: CVE-2026-120442 has no CISA KEV entry in the source data. KEV does not confirm active exploitation at this time. A public write-up of the token forgery technique is listed in the references. NVD currently marks the record as "Deferred".
What's Vulnerable
- Vendor: xianhc
- Product: ape-volo-admin
- Affected versions: all versions before 3.6.1 (semver range 0 to <3.6.1)
- Repository: https://github.com/xianhc/ape-volo-admin
Versions outside that range are marked unaffected. NVD has not published CPE entries for this CVE. Within the affected range, deployments are exploitable this way if they still use the shipped JWT signing key and the default seeded administrator account.
Patch Status
The fix is in ape-volo-admin V3.6.1. The references also include a fix commit (938f7ec) and a related GitHub issue (#36). Anyone running an affected version should upgrade to 3.6.1 or later. Until then, operators should check whether they still use the default signing key from appsettings.json and replace it with a unique secret. CISA has not issued a required action because there is no KEV entry.
Sources
- NVD – CVE-2026-120442
- VulnCheck Advisory – ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass
- GitHub – ape-volo-admin V3.6.1 Release
- GitHub – Fix Commit 938f7ec
- GitHub – Issue #36
- GitHub – appsettings.json (V3.5.2)
- GitHub – PermissionHandler.cs (V3.5.2)
- GitHub – AuthorizationExtensions.cs (V3.5.2)
- HackMD – Researcher Write-up: Hardcoded JWT Secret Admin Token Forgery