CVE-2026-110612Critical· 9.8▾ AbyssalPoC availablevlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary grou…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
Last analysed / modified upstream
1.0%
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112345High· 8.1TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure
CVE-2026-113466Medium· 5.3MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key
CVE-2026-111612High· 7.5netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi
CVE-2026-111633High· 8.6ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key
CVE-2026-111642High· 8.8FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser
CVE-2026-111690Critical· 9.8Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass