AI analysis
Claude Opus · 7 Nov 2026, 10:21 CET
Hardcoded JWT key in ape-volo-admin lets attackers forge admin tokens
ape-volo-admin before 3.6.1 ships with a hardcoded JWT signing key in appsettings.json, letting unauthenticated attackers forge administrator tokens offline and gain full API control. Upgrade to 3.6.1.
In plain terms
ape-volo-admin is an administration platform. Versions before 3.6.1 include a secret key, used to sign login tokens, directly inside a configuration file (appsettings.json). Because this key is the same for every unmodified installation, anyone who sees the public source code knows it.
With that key, an attacker does not need a password. They can create a valid-looking token offline that identifies them as the built-in administrator and then command the system's API. Anyone running this software, especially where it is reachable over a network, should treat this as urgent.