Threats tagged 'ghsa-c4wp-cj2h-5rj2'

An authentication bypass vulnerability exists in ape-volo-admin versions before 3.6.1. This flaw allows unauthenticated attackers to forge administrator tokens by exploiting a hardcoded JWT signing key found in the appsettings.json file. Using this key, attackers can create tokens offline with the jti claim set to the seeded administrator ID, granting full API control over users, roles, permissions, and data.