EUVD-2026-101240
GHSA-v9cf-gm8v-mp4m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate internet-exposed vlife instance
-
DeliveryExtract hardcoded HS256 key from public source
-
ExploitForge JWT with superUser=true claim
-
ExecutionSubmit token to any vlife endpoint
-
ImpactGain super administrator access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Key management, no hard-coded keys
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of vlife (wwwlike/vlife) through version 2.0.1, because the HS256 signing key is hardcoded in TokenUtil and shipped identically to every installation. The attacker needs only the key, which is published in the project's open GitHub source, and can then forge a token with superUser=true and arbitrary groupIds. The only real limiting factor is exposure: the vlife instance must be network-reachable by the attacker; no user interaction, no prior authentication, and no non-default setting is required. |
| Impact | All signals point to a genuine high-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with high confidentiality, integrity, and availability impact to the vulnerable system (VC:H/VI:H/VA:H), consistent with the 9.3 score and the CWE-321 (use of hard-coded cryptographic key) root cause. The hardcoded HS256 signing key lives in publicly readable source on GitHub (TokenUtil.java), so the single technical barrier to forging an administrator token is effectively zero - a detailed public writeup (hackmd) documents the forgery technique. No EPSS score was provided in the input, and the vulnerability is NOT listed in CISA KEV, so there is no evidence of confirmed active exploitation; the realistic weighting is 'trivially exploitable and well-documented, but exploitation prevalence unmeasured.' The dominant mitigating factor is not technical difficulty but deployment footprint: vlife is a niche open-source platform, so impact is bounded by how many internet-exposed instances exist rather than by exploit complexity. No conflicting signals were found between the CVSS vector and the description - both agree on remote unauthenticated access. |
| Exploit ScenarioDerived | An unauthenticated attacker reads the hardcoded HS256 secret directly from vlife's public GitHub source, then forges a JWT containing superUser=true and arbitrary groupIds claims. They present this self-signed token to any vlife endpoint and are granted super administrator access to the entire application. A public technical writeup documenting the forgery exists, though no packaged exploit tool was identified in the provided references. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Authentication bypass in vlife through 2.0.1 enables unauthenticated remote attackers to forge HS256 JSON Web Tokens using a hardcoded signing key, granting super administrator access to any URL on affected instances. The vulnerability carries a CVSS 9.3 (CVSS:4.0) and CWE-321, with all default installations affected because the key is embedded in the open-source TokenUtil class. Exploitation requires only network reachability; no public exploit code has been identified at time of analysis.
RemediationAI
No vendor-released patch has been identified at time of analysis. The primary remediation is to replace the hardcoded HS256 signing key in TokenUtil.java with an environment-specific secret (e.g., loaded from a secure vault or environment variable) and rebuild the application, then invalidate all existing tokens by rotating the key. Until a patched version is available, administrators should restrict network access to vlife instances using firewall rules or VPNs, as the vulnerability requires the instance to be reachable; this mitigation limits exposure but may hinder legitimate remote access. Additionally, monitor for anomalous tokens with superUser=true or unexpected groupIds claims, and consider adding an external authentication gateway or WAF rule to block forged JWTs, though these are compensating controls with potential performance and maintenance overhead. Refer to the VulnCheck advisory for updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-321 (Use of Hard-coded Cryptographic Key). vlife's TokenUtil.java (lines 33-58) hardcodes the HS256 secret used to sign and verify JWTs, and VlifeUrlDecisionManager.java (line 25) enforces authorization decisions based on token claims. Because the same key ships with every vlife installation up to 2.0.1, an attacker who reads the public GitHub repository can generate a valid token with superUser=true and arbitrary groupIds. The HS256 algorithm uses a shared symmetric secret, so knowledge of the key allows token forgery without any prior authentication. The CPE cpe:2.3:a:wwwlike:vlife:*:*:*:*:*:*:*:* confirms all versions through 2.0.1 are affected.
Know when Vlife gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Hardcoded key is public and identical across installs, so remote unauthenticated token forgery gives full admin: AV:N, AC:L, PR:N, UI:N, with high C/I/A on the application itself (S:U).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.
Executive ViewAI
A critical authentication bypass (CVE-2026-110612, CVSS 9.3) in the open-source vlife platform through version 2.0.1 allows anyone with network access to forge administrator tokens and gain full super-administrator control of an affected instance, because a hardcoded signing key ships in every default installation. This affects all default deployments rather than a narrow configuration, so any team running vlife - particularly internet-facing instances or those holding sensitive data and integrations - must assume full administrative compromise is possible until the key is replaced or the component is retired. Leadership should care because super-admin access enables data theft, configuration tampering, and lateral movement into any system that trusts vlife for identity or workflow decisions.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to vlife instances via allowlisting, VPN, or private networking; forcibly rotate and externalize the hardcoded HS256 signing key so forged tokens no longer validate; invalidate all active sessions and tokens; place an API gateway or WAF in front of administrative endpoints to reject tokens signed with the known embedded key; monitor and alert on anomalous super-admin token issuance and usage; and decommission or isolate non-essential instances until a fixed version is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB