Simple Admin Core EUVD-2026-102981

Exploitable against any Simple Admin Core deployment through v1.8.7 that runs with the shipped default Auth.AccessSecret (jS6VKDtsJf3z1n2VKDtsJf3z1n2) present in api/etc/core.yaml and in the all_in_one/postgresql and core-only docker-compose configs. No authentication, no user interaction, and no non-default feature are required - the signing secret is published in the vendor repository, so any attacker with network reach to the core API (default port 9100) can forge a valid super-admin JWT. The single limiting factor is configuration: operators who manually replaced AccessSecret with their own private value before deployment are NOT vulnerable, as the forged signature will no longer validate.

All available signals align toward genuine high priority rather than inflated scoring. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H, score 9.3) indicates fully remote, unauthenticated, low-complexity exploitation with total impact - and this is corroborated by the root cause: CWE-321 (use of a hard-coded cryptographic key). The GitHub source diff confirms the exact secret (AccessSecret: jS6VKDtsJf3z1n2VKDtsJf3z1n2) was committed in api/etc/core.yaml and three docker-compose shipping configs, so the 'secret' is literally public, making token forgery trivial and deterministic - consistent with the PR:N / AC:L rating. The vulnerability was reported by VulnCheck and a detailed public writeup (hackmd) describes the forging technique, so exploitation knowledge is already in the open; however there is no CISA KEV listing and no EPSS score in the provided data, so there is no confirmation of active in-the-wild exploitation at this time. The conflict to note explicitly: the maximal CVSS and public, trivial exploit path argue for urgent patching, but the real-world blast radius is tempered by the product's niche footprint and by the fact that only deployments still using the shipped default secret are affected - operators who replaced the secret are not exploitable.

An attacker reads the hard-coded Auth.AccessSecret value directly from the public suyuan32/simple-admin-core repository, then uses it to sign a JWT containing the super-administrator roleId claim '001'. They send this forged token to the exposed core API and are accepted as a full super admin, letting them manipulate users, roles, menus, API authorities, configuration and tokens - all without any credentials. A public technical writeup already documents this exact forging method, making reproduction straightforward.