---
id: CVE-2026-120442
title: ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass
summary: >-
  ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability
  that allows unauthenticated attackers to forge administrator tokens using a
  hardcoded JWT signing key in appsettings.json. Attackers can sign tokens
  offline with…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-1394
vendor: xianhc
product: ape-volo-admin
affected:
  - ape-volo-admin < 3.6.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-11-05T21:38:59.409940Z'
exploitAvailable: true
published: '2026-11-02'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:39:20.223Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120442'
references:
  - url: 'https://github.com/xianhc/ape-volo-admin/issues/36'
  - url: >-
      https://github.com/xianhc/ape-volo-admin/commit/938f7ec58047f0c63123dc155d6a033910f00933
  - url: 'https://github.com/xianhc/ape-volo-admin/releases/tag/V3.6.1'
    label: ape-volo-admin V3.6.1 Release Notes
  - url: >-
      https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Api/appsettings.json#L4-L10
  - url: >-
      https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Extensions/AuthorizationExtensions.cs#L50-L60
  - url: >-
      https://github.com/xianhc/ape-volo-admin/blob/V3.5.2/Ape.Volo.Infrastructure/Authentication/PermissionHandler.cs#L130-L172
  - url: >-
      https://hackmd.io/@hieuPenguinnn/ape-volo-admin-hardcoded-jwt-secret-admin-token-forgery
  - url: >-
      https://www.vulncheck.com/advisories/ape-volo-admin-before-3.6.1-hardcoded-jwt-signing-key-authentication-bypass
    label: >-
      VulnCheck Advisory: ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key
      Authentication Bypass
tags:
  - cve.org
  - exploit-available
epss: 0.01707
epssPercentile: 0.77447
exploits:
  nuclei:
    - CVE-2026-120442
  checkedAt: '2026-11-07T18:07:46.586Z'
ingestedAt: '2026-11-05T19:30:42.654Z'
---

## Overview

ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.

## Affected

- `ape-volo-admin < 3.6.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.