CVE-2026-111633

8.6High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.6High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on integrity
Weakness: CWE-321

Impact

Unauthenticated remote attackers can bypass API authentication to read form submissions and modify articles and products. They only need network access to the REST API to forge admin JWT bearer tokens.

Root cause

A hard-coded HMAC-SHA256 secret key in JwtBearerDefaults.cs is used to sign and validate REST API JWT bearer tokens.

Affected systems

ZKEACMS through 4.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Fix & remediation

No fixed version is currently specified; restrict network access to the API endpoints or patch the source code by replacing the hard-coded key in JwtBearerDefaults.cs and BuilderAuthentication.cs with an environment-configured secret.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111633