Botsharp
Monthly
Hard-coded JWT signing key in BotSharp through 5.2.0 allows unauthenticated remote attackers to forge bearer tokens and impersonate any user, including administrators, on Authorize-protected API routes. Exploitation requires the deployment to retain the default key and default 'botsharp' issuer/audience; rotating these values mitigates the issue. No public exploit code has been identified at the time of analysis, but the high impact and low complexity make this a genuine high-priority risk as confirmed by independent assessment.
Hard-coded JWT signing key in BotSharp through 5.2.0 allows unauthenticated remote attackers to forge bearer tokens and impersonate any user, including administrators, on Authorize-protected API routes. Exploitation requires the deployment to retain the default key and default 'botsharp' issuer/audience; rotating these values mitigates the issue. No public exploit code has been identified at the time of analysis, but the high impact and low complexity make this a genuine high-priority risk as confirmed by independent assessment.