CVE-2026-110612
9.8CriticalPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-321
Impact
Unauthenticated remote attackers can forge administrative JWT tokens and gain super administrator access across all vlife URLs. They only need network access to the application endpoints.
Root cause
The application relies on a hardcoded HS256 secret key in TokenUtil to sign and verify JWT authentication tokens.
Affected systems
vlife through 2.0.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
No patched version is documented; restrict external network access to the vlife instance or rebuild the application with an externally supplied, unique secret key in TokenUtil.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.
References
- https://github.com/wwwlike/vlife
- https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653f5b0d9a70721734d6d/vlife-base/src/main/java/cn/wwwlike/config/VlifeUrlDecisionManager.java#L25
- https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653f5b0d9a70721734d6d/vlife-boot-starter-web/src/main/java/cn/wwwlike/web/security/filter/TokenUtil.java#L33-L58
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vlife-hardcoded-jwt-secret-token-forgery
- https://www.vulncheck.com/advisories/vlife-through-2.0.1-authentication-bypass-via-hardcoded-jwt-secret-in-tokenutil
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vlife-hardcoded-jwt-secret-token-forgery