CVE-2026-108860

Name of the Vulnerable Software and Affected Versions BotSharp versions prior to 5.2.1

Description An authentication bypass exists that allows unauthenticated remote attackers to forge bearer tokens. This is possible because the WebStarter appsettings.json file contains a hard-coded Jwt:Key. Attackers can use this committed HMAC secret, along with a fixed botsharp issuer and audience, to sign tokens and impersonate any known user, including administrators, when accessing Authorize-protected API routes.

Recommendations Replace the default JWT signing key with a unique, cryptographically secure secret. Restrict external API access immediately. Invalidate existing tokens and review privileged accounts for suspicious historical access.