ape-volo-admin vulnerabilities

CVEs whose affected-version data names the ape-volo-admin package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-120442Critical· 9.8PoC

6d ago

ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass

ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with…

▾ Abyssalxianhc · ape-volo-adminEPSS 1.7%via CVEORG