{"id":"CVE-2026-120201","title":"Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header","summary":"Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a valu…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-943"],"vendor":"dromara","product":"Jpom","affected":["Jpom >= 2.10.0 <= 2.11.12"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-11-02T14:35:05.869681Z"},"exploitAvailable":true,"published":"2026-10-31","updated":"2026-11-02","sourceUpdated":"2026-11-02T14:35:22.658Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120201","references":[{"url":"https://github.com/dromara/Jpom/issues/121","label":"GitHub Issue #121"},{"url":"https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/common/interceptor/LoginInterceptor.java#L146"},{"url":"https://github.com/dromara/Jpom"},{"url":"https://www.vulncheck.com/advisories/jpom-2.10.0-through-2.11.12-authentication-bypass-via-jpom-user-token-header","label":"VulnCheck Advisory: Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header"}],"tags":["cve.org","exploit-available"],"epss":0.00603,"epssPercentile":0.48974,"exploits":{"nuclei":["CVE-2026-120201"],"checkedAt":"2026-11-05T19:31:18.359Z"},"ingestedAt":"2026-11-05T19:30:42.666Z","slug":"CVE-2026-120201","body":"## Overview\n\nJpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.\n\n## Affected\n\n- `Jpom >= 2.10.0 <= 2.11.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":66,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}