CVE-2026-108860: Use of Hard-coded Cryptographic Key in SciSharp BotSharp

CVE-2026-108860 identifies an authentication bypass vulnerability in BotSharp through version 5.2.0. The vulnerability arises from the use of a hard-coded cryptographic key (Jwt:Key) in the WebStarter appsettings.json configuration file. Attackers can exploit this by signing bearer tokens with the known HMAC secret and fixed issuer and audience values, allowing them to impersonate any user, including administrators, on API routes protected by authorization mechanisms.

Exploitation of this vulnerability allows unauthenticated remote attackers to bypass authentication controls entirely by forging valid bearer tokens. This can lead to full impersonation of any user, including those with administrative privileges, potentially resulting in unauthorized access to sensitive data and system functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid deploying affected versions or consider mitigating by changing the Jwt:Key to a secure, unique value and ensuring it is not hard-coded or committed in configuration files.