CVE-2026-110612: Use of Hard-coded Cryptographic Key in wwwlike vlife

CVE-2026-110612 describes an authentication bypass vulnerability in vlife through version 2.0.1. The issue arises from the use of a hardcoded cryptographic key for signing JWT tokens in the TokenUtil component. Attackers can exploit this by forging JWTs signed with the known HS256 key, setting the superUser claim to true and arbitrary groupIds, thereby gaining unauthorized super administrator access to any URL on the affected vlife instances.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and gain super administrator privileges across the entire vlife application. This can lead to full compromise of the affected system, unauthorized access to sensitive data, and potential further malicious actions within the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to vlife instances and monitor for suspicious JWT usage. Avoid deploying affected versions in production environments if possible.