Vlife
Monthly
Authentication bypass in vlife through 2.0.1 enables unauthenticated remote attackers to forge HS256 JSON Web Tokens using a hardcoded signing key, granting super administrator access to any URL on affected instances. The vulnerability carries a CVSS 9.3 (CVSS:4.0) and CWE-321, with all default installations affected because the key is embedded in the open-source TokenUtil class. Exploitation requires only network reachability; no public exploit code has been identified at time of analysis.
Authentication bypass in vlife through 2.0.1 enables unauthenticated remote attackers to forge HS256 JSON Web Tokens using a hardcoded signing key, granting super administrator access to any URL on affected instances. The vulnerability carries a CVSS 9.3 (CVSS:4.0) and CWE-321, with all default installations affected because the key is embedded in the open-source TokenUtil class. Exploitation requires only network reachability; no public exploit code has been identified at time of analysis.