PT-2026-141206

CVE-2026-125383

·

Published

2026-11-09

·

Updated

2026-11-10

Description by

CVSS 3.1
9.8
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) versions prior to 10.20261109
Description An authentication bypass exists due to a hard-coded JWT (JSON Web Token) signing key, issuer, and audience within the appsettings.json file. Unauthenticated remote attackers can forge tokens for any user ID and role trusted by the Tokens/DI.cs validator, allowing them to gain administrator access to the entire API.
Recommendations Update INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) to version 10.20261109.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-321: Use of Hard-coded Cryptographic Key
Related identifiers
CVE-2026-125383
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com