CVE-2026-120442

Name of the Vulnerable Software and Affected Versions ape-volo-admin versions prior to 3.6.1

Description An authentication bypass exists that allows unauthenticated attackers to forge administrator tokens. This is possible due to a hardcoded JWT (JSON Web Token) signing key located in the appsettings.json file. Attackers can sign tokens offline by setting the jti claim to the seeded administrator ID, granting them full API control over users, roles, permissions, and data.

Recommendations Update to version 3.6.1 or later.