[CVE-2026-111633] ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated atta…

Descripción técnica

ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.

Puntuación CVSS

Score: 8.6/10 — Severidad: HIGH — Estado NIST: Received

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Debilidades (CWE)

CWE-321

Fuente oficial

Publicado en NIST NVD.