Ape Volo Admin
Monthly
Authentication bypass in ape-volo-admin before 3.6.1 lets unauthenticated, network-reachable attackers forge administrator JWTs because the application ships a hardcoded JWT signing key in Ape.Volo.Api/appsettings.json. Because that key is published in the project's public source, an attacker can sign a token offline with the jti claim set to the seeded administrator id and obtain full API control over users, roles, permissions and data; the flaw is rated 9.3 (CVSS 4.0) and prioritised act_now. Default deployments are the exposed population, while instances whose operators replaced the signing key with a unique secret are not forgeable this way, and upgrading to 3.6.1 resolves the issue completely. No confirmed active exploitation or verified working exploit code is documented in the available data, though a public PoC reference exists.
Authentication bypass in ape-volo-admin before 3.6.1 lets unauthenticated, network-reachable attackers forge administrator JWTs because the application ships a hardcoded JWT signing key in Ape.Volo.Api/appsettings.json. Because that key is published in the project's public source, an attacker can sign a token offline with the jti claim set to the seeded administrator id and obtain full API control over users, roles, permissions and data; the flaw is rated 9.3 (CVSS 4.0) and prioritised act_now. Default deployments are the exposed population, while instances whose operators replaced the signing key with a unique secret are not forgeable this way, and upgrading to 3.6.1 resolves the issue completely. No confirmed active exploitation or verified working exploit code is documented in the available data, though a public PoC reference exists.