CVE-2026-111633
HighCVSS 8.6Summary
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.
Risk Assessment
An unauthenticated attacker can gain administrator privileges, modify content (articles, products) and read form submissions, compromising data integrity and confidentiality.
Recommendation
Upgrade ZKEACMS beyond 4.4 and replace the hard-coded HMAC-SHA256 signing key with a unique, random key stored securely.
Other vulnerabilities in ZKEACMS
Original NVD description (English source)
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS