ape-volo-admin CVE-2026-120442

Exploitation requires that the target ape-volo-admin instance (any version before 3.6.1) runs with the default hardcoded JWT signing key shipped in Ape.Volo.Api/appsettings.json and is network-reachable; because that key is published in the project's public source, any attacker can sign a valid administrator token offline with the jti claim set to the seeded administrator id. No authentication, privileges or user interaction are needed (CVSS PR:N/UI:N). The one practical limiting factor is key configuration: an operator who replaced the default signing key with a secret, unique value before deployment would break token forgery; upgrading to 3.6.1 (which the vendor fixed in commit 938f7ec) is the complete remediation.

All available signals align toward high real-world risk for exposed instances. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity flaw needing no privileges or user interaction, with high confidentiality, integrity and availability impact to the vulnerable system (VC:H/VI:H/VA:H), consistent with the described full API takeover of users, roles, permissions and data. The vuln.today decision label is act_now and the finding is attributed to VulnCheck with a dedicated advisory, and a public PoC reference exists (an independent HackMD write-up); it is not verified as working exploit code. There is no KEV listing and no EPSS score in the provided data, so active in-the-wild exploitation is not confirmed and widespread-exploitation probability cannot be quantified from these inputs - the priority here rests on the act_now decision label, the trivial exploitability, and the fact that the signing key is published in the project's own source tree rather than on observed attacks. One caveat worth verifying: exploitation presumes the operator left the shipped hardcoded JWT key in place, which is the default but can be overridden in a given deployment.

An attacker who can reach the ape-volo-admin API retrieves the hardcoded JWT signing key from the public appsettings.json in the project's repository, then crafts and signs a valid administrator JWT offline with the jti claim set to the seeded administrator id. Presenting this forged token, the unauthenticated attacker is treated as the seeded admin and gains full control over user, role, permission and data endpoints. A public PoC reference exists (HackMD write-up); it is not verified as working exploit code.