critical · CVSS v3 9.8 · CVSS v4 9.3

CVE-2026-125383

INDOTALENT WHMS before 10.20261109 has an authentication bypass due to hard‑coded JWT signing key, issuer, and audience. Unauthenticated att

Overview

INDOTALENT WHMS before 10.20261109 has an authentication bypass due to hard‑coded JWT signing key, issuer, and audience. Unauthenticated attackers can forge tokens and impersonate any user, including administrators. This flaw allows full control over the API.

Description

INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API.

Impact

Confidentiality: attackers can access all API data. Integrity: they can modify orders and inventory. Availability: potential for disruptive changes. Defenders: system administrators and security teams must be aware of the risk.

Remediation

Update to version 10.20261109 or later where the JWT key is no longer hard‑coded. If patch not available, replace the hard‑coded key, issuer, and audience with secure, environment‑based values and enforce token validation. Rotate any compromised tokens and audit logs for suspicious activity.

Risk context

Severity is critical with CVSS 9.8, indicating a high‑risk vulnerability. No EPSS data, but the flaw is exploitable remotely without authentication, so immediate attention is required.

Affected products

  • INDOTALENT WHMS
  • Asp.Net-Core-Inventory-Order-Management-System

Scores

Severity
critical
CVSS v2
10
CVSS v3
9.8
CVSS v4
9.3
EPSS
—

authentication-bypass jwt hardcoded-key critical api aspnetcore token-forgery

← All CVEs

Related CVEs

critical

CVE-2026-125358

Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.

View analysis

critical

CVE-2026-125370

Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.

View analysis

critical

CVE-2026-125384

INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.

View analysis

critical

CVE-2026-107242

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from the system’s date and time and its MAC address. As a result, successive identifiers differ only slightly and can be predicted. An attacker who can predict a user’s session ID could hijack that user’s session. Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.

View analysis