CVE-2026-111690

9.8Critical

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-321

Impact

Unauthenticated remote attackers can forge super administrator JWTs to take full administrative control over the application. They only need network access to the API endpoint.

Root cause

The application ships with a static, hard-coded JWT secret (Auth.AccessSecret) in api/etc/core.yaml.

Affected systems

Simple Admin Core through 1.8.7

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to a version beyond 1.8.7 when available. Immediately rotate the Auth.AccessSecret in api/etc/core.yaml to a secure random string and restart the service.

shell

$ sed -i "s/AccessSecret:.*/AccessSecret: $(openssl rand -hex 32)/" api/etc/core.yaml

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111690