Simple Admin Core
Monthly
Authentication bypass in Simple Admin Core through v1.8.7 lets unauthenticated remote attackers forge a valid super-administrator JWT by signing it with the hard-coded Auth.AccessSecret (jS6VKDtsJf3z1n2VKDtsJf3z1n2) shipped in api/etc/core.yaml, then set roleId 001 to obtain full administrative control over users, roles, menus, API authorities, configuration and token issuance. Exploitation requires only network reach to the core API (default port 9100) against a deployment that still runs the vendor's default secret - no credentials and no user interaction - and the CVSS 4.0 base score is 9.3, corroborated by the independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (unauthenticated, network-exploitable, full confidentiality/integrity/availability impact). No public exploit identified at time of analysis, although a public technical writeup detailing the bypass exists, and deployments that rotated AccessSecret to a private value before deployment are not exploitable via forged signatures.
Authentication bypass in Simple Admin Core through v1.8.7 lets unauthenticated remote attackers forge a valid super-administrator JWT by signing it with the hard-coded Auth.AccessSecret (jS6VKDtsJf3z1n2VKDtsJf3z1n2) shipped in api/etc/core.yaml, then set roleId 001 to obtain full administrative control over users, roles, menus, API authorities, configuration and token issuance. Exploitation requires only network reach to the core API (default port 9100) against a deployment that still runs the vendor's default secret - no credentials and no user interaction - and the CVSS 4.0 base score is 9.3, corroborated by the independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (unauthenticated, network-exploitable, full confidentiality/integrity/availability impact). No public exploit identified at time of analysis, although a public technical writeup detailing the bypass exists, and deployments that rotated AccessSecret to a private value before deployment are not exploitable via forged signatures.