ZKEACMS CVE-2026-111633

Exploitation requires the target ZKEACMS instance (version <=4.4) to expose its REST API / ApiAuthorize endpoints, which authenticate via JWT bearer tokens signed with the key hard-coded in JwtBearerDefaults.cs. Because that key ships in the source and is the same across all installations, no non-default configuration, credentials, or user interaction is needed - any instance running the vulnerable API accepts attacker-forged tokens bearing the Name claim 'admin'. The primary limiting factor is reachability and use of the REST API: deployments that do not expose the API endpoints to the attacker reduce exposure, but the signing key itself is a default-condition weakness, not an opt-in one.

This is a genuine high-priority issue rather than an inflated CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack, which is fully consistent with CWE-321 (hard-coded cryptographic key): the HMAC-SHA256 signing secret is embedded in the shipped source (JwtBearerDefaults.cs), so any attacker can forge a valid admin JWT without credentials, with no conflict between the vector and the description. The 8.8 severity is driven by high integrity impact (VI:H - forging an admin token to modify articles and products) with lower confidentiality (VC:L - reading form submissions) and limited availability (VA:L). No EPSS score, KEV listing, or POC flag was supplied in the input, so there is no confirmed signal of active exploitation or published exploit code; however, the referenced HackMD write-up and VulnCheck advisory document the exact forging technique, meaning the barrier to weaponization is trivial. The real-world risk is therefore gated almost entirely by deployment footprint rather than technical difficulty: ZKEACMS is a niche open-source .NET CMS, so widespread opportunistic exploitation is less likely than targeted attacks against known installations. Net: technically easy and reliable to exploit, but modest real-world blast radius due to limited product prevalence.

An unauthenticated attacker locates an internet-facing ZKEACMS instance (<=4.4) exposing its REST API, then uses the publicly known hard-coded HMAC-SHA256 key to mint a JWT bearer token with the Name claim set to 'admin'. With that forged token they call ApiAuthorize endpoints to modify articles and products and read submitted form data. Given AV:N/AC:L/PR:N/UI:N, no special timing, user interaction, or credentials are needed, and a detailed public write-up describes the method.