CVE-2026-120201

Name of the Vulnerable Software and Affected Versions Jpom versions 2.10.0 through 2.11.12

Description An authentication bypass exists that allows unauthenticated attackers to gain super-administrator access. This is achieved by injecting query conditions into the JPOM-USER-TOKEN header. Specifically, providing a value such as 'is not null' is misinterpreted as an operator by Hutool's Condition parser, enabling the attacker to bypass login and execute server commands via script features.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.