CVE-2026-110612
CVE-2026-110612 · vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil
This page contains facts from public vulnerability sources. Check the original advisory before updating.
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.
CVSS 9.3 · Critical · EPSS 1.0%
- Published
- Updated
Affected products and versions
vlife
- Versions
- ≥ 0, ≤ 2.0.1: Affected (semver)
No fix published
Original sources
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vlife-hardcoded-jwt-secret-token-forgery
- https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653f5b0d9a70721734d6d/vlife-boot-starter-web/src/main/java/cn/wwwlike/web/security/filter/TokenUtil.java#L33-L58
- https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653f5b0d9a70721734d6d/vlife-base/src/main/java/cn/wwwlike/config/VlifeUrlDecisionManager.java#L25
- https://github.com/wwwlike/vlife
- https://www.vulncheck.com/advisories/vlife-through-2.0.1-authentication-bypass-via-hardcoded-jwt-secret-in-tokenutil
- https://nvd.nist.gov/vuln/detail/CVE-2026-110612