https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-07T10:05:40.112040+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-120442 CVE-2026-120442 — ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass 2026-11-07T10:05:40.114404+00:00

Affected: xianhc ape-volo-admin

ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.