Versions of INDOTALENT WHMS before 10.20261109 ship with a hard-coded JWT signing key, issuer and audience. If a deployment still uses these default values, a remote attacker with no credentials can use them to forge tokens and could take administrator control of the whole API.
What Is It
CVE-2026-125383 is an authentication bypass in INDOTALENT WHMS, also known as Asp.Net-Core-Inventory-Order-Management-System. The JWT signing key, issuer and audience are hard-coded in appsettings.json. Anyone who has those values can sign their own tokens with any user ID and any role that the Tokens/DI.cs validator trusts. On instances that keep the shipped configuration, the validator accepts those tokens as real.
The weakness is CWE-321 (Use of Hard-coded Cryptographic Key). VulnCheck reported the issue, and the NVD record has the status "Received."
Why It Matters
- No login or user action needed. The attack works over the network and needs no privileges and no user interaction.
- Possible full administrator access. On a deployment that uses the default key, a forged token can give admin access to the entire API. Instances where operators have replaced the key, issuer and audience with their own values are not exposed in the same way.
- Critical scores. CVSS 3.1 is 9.8 (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CVSS 4.0 from VulnCheck is 9.3. Both rate confidentiality, integrity and availability impact as High.
Exploitation status: CVE-2026-125383 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, so CISA has not confirmed active exploitation. No exploit-maturity rating has been published for this vulnerability.
What's Vulnerable
- Vendor: go2ismail
- Product: Asp.Net-Core-Inventory-Order-Management-System (INDOTALENT WHMS)
- Affected versions: all versions before 10.20261109
- Default status: versions outside that range are listed as unaffected
The hard-coded values are in Presentation/ASPNET/appsettings.json (lines 38–44) at tag v9.20250118. The NVD record lists no CPEs.
Patch Status
The affected range ends at 10.20261109. The project has published a v10.20261109 release tag and two related commits. Operators should upgrade to 10.20261109 or later. They should also make sure no deployment still uses the old shipped signing key, issuer or audience.
The CVE is not in the KEV catalog, so CISA has issued no required action or due date. No other mitigations have been published.