CVE-2026-111633CWE-321

CVE-2026-111633

High · published October 16, 2026

CVSS v3.1

8.6

EPSS

Percentile

26.3

In the wild

Unconfirmed

What it is

ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.

The record

Technical detail

CVSS v3.1: 8.6 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0: 8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS: 0.00340 · 26.3th percentile
Weakness: CWE-321 · Use of Hard-coded Cryptographic Key
Published: 2026-10-16T22:17Z

References (7)

https://www.vulncheck.com/advisories/zkeacms-through-4.4-authentication-bypass-via-hard-coded-jwt-signing-key · [email protected]https://github.com/SeriaWei/ZKEACMS/issues/531 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 https://hackmd.io/@hieuPenguinnn/zkeacms-hardcoded-jwt-signing-key-admin-auth-bypass · 134c704f-9b21-4f2e-91b3-4a467353bcc0 https://github.com/SeriaWei/ZKEACMS/blob/v4.4/src/ZKEACMS/Api/JwtBearerDefaults.cs#L14-L19 · [email protected]https://github.com/SeriaWei/ZKEACMS/blob/v4.4/src/ZKEACMS/BuilderAuthentication.cs#L41-L52 · [email protected]https://github.com/SeriaWei/ZKEACMS/issues/531 · [email protected]https://hackmd.io/@hieuPenguinnn/zkeacms-hardcoded-jwt-signing-key-admin-auth-bypass · [email protected]

EPSS history

Timeline

18 OCT 03:27Z
EPSS moved — → 0%
epss
16 OCT 17:39Z
ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key
cvelistv5
16 OCT 17:39Z
ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key
cvelistv5