Jpom CVE-2026-120201

No special conditions beyond running an affected version - remote unauthenticated exploitation against default configurations of Jpom 2.10.0 through 2.11.12. The specific prerequisite is that the attacker supplies a crafted JPOM-USER-TOKEN header value (e.g. 'is not null') that Hutool's Condition parser treats as a query operator, which the LoginInterceptor uses without neutralization; this alone yields super-administrator authentication. The subsequent command-execution step relies on Jpom's script features, which are available to the super-administrator role the bypass grants. The principal limiting factor is version: only the 2.10.0-2.11.12 range is stated as affected; no authentication, user interaction, or non-default setting is required for the bypass itself.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA all High, score 9.3) describes a remotely reachable, low-complexity, pre-authentication flaw with full confidentiality, integrity, and availability impact on the vulnerable system, consistent with an authentication bypass that yields super-administrator access and, via Jpom's script features, command execution. The vuln.today decision label is act_now and the finding is attributed to VulnCheck, which published a dedicated advisory and references the exact vulnerable code path (LoginInterceptor.java at v2.11.12). Several key risk signals are MISSING from the input: there is no EPSS exploitation-probability score provided, and there is no CISA KEV listing, so this is not confirmed as actively exploited - the urgency rests on severity and exploitability, not on observed in-the-wild use. No input field marks a working proof-of-concept exploit as confirmed; the references are an advisory, the source repository, and a GitHub issue rather than a flagged exploit artifact. In short: the technical risk is severe and the preconditions for exploitation are minimal, but exploitation prevalence cannot be quantified from the data supplied.

A remote, unauthenticated attacker sends an HTTP request to a Jpom server (versions 2.10.0-2.11.12) with the JPOM-USER-TOKEN header set to a crafted value such as 'is not null'. Hutool's Condition parser interprets this as a query operator rather than a literal token, causing the login interceptor to match a user record and grant super-administrator access, after which the attacker uses Jpom's built-in script features to execute operating-system commands on the host. No confirmed working public exploit is identified in the input, though a VulnCheck advisory and a GitHub issue describing the flaw are referenced.