ape-volo-admin hardcoded JWT key allows authentication bypass

If the admin program keeps its default settings, anyone can become an administrator!

Summary

Versions of ape-volo-admin before 3.6.1 use a JWT signing key fixed in a configuration file. Unauthenticated attackers can forge administrator tokens and gain full control over users, roles, permissions and data.

Affected when

Using the hardcoded JWT signing key in appsettings.json

What to do

Update to 3.6.1 or later.

Products and platforms

ape-volo-admin

CVE IDs

CVE-2026-120442 (opens in a new tab)

Sources

Advisory: github.com (opens in a new tab)
Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · hackmd.io (opens in a new tab) · vulncheck.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-02 14:29 UTC

First seen 2026-11-09 14:10 UTC