CVE-2026-111690: Use of Hard-coded Cryptographic Key in suyuan32 simple-admin-core

CVE-2026-111690 describes an authentication bypass vulnerability in Simple Admin Core through version 1.8.7. The vulnerability arises from the use of a hard-coded cryptographic key (Auth.AccessSecret) located in the api/etc/core.yaml configuration file. Attackers can leverage this secret to forge JSON Web Tokens (JWTs) with a roleId claim of '001', effectively impersonating a super administrator. This grants them unrestricted administrative privileges, enabling control over users, roles, menus, API authorities, configurations, and tokens within the application.

Exploitation of this vulnerability allows unauthenticated attackers to gain full administrative privileges in Simple Admin Core, compromising the integrity and confidentiality of the system. Attackers can manipulate user accounts, roles, menus, API permissions, configurations, and authentication tokens, potentially leading to complete system takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the configuration file containing the hard-coded key and consider implementing additional authentication controls or monitoring for suspicious JWT usage. Avoid deploying affected versions in sensitive environments.