ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 8.8NVD modified 2026-10-16 19:04
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 7
- https://github.com/SeriaWei/ZKEACMS/blob/v4.4/src/ZKEACMS/Api/JwtBearerDefaults.cs#L14-L19
- https://github.com/SeriaWei/ZKEACMS/blob/v4.4/src/ZKEACMS/BuilderAuthentication.cs#L41-L52
- https://github.com/SeriaWei/ZKEACMS/issues/531
- https://hackmd.io/@hieuPenguinnn/zkeacms-hardcoded-jwt-signing-key-admin-auth-bypass
- https://www.vulncheck.com/advisories/zkeacms-through-4.4-authentication-bypass-via-hard-coded-jwt-signing-key
- https://github.com/SeriaWei/ZKEACMS/issues/531
- https://hackmd.io/@hieuPenguinnn/zkeacms-hardcoded-jwt-signing-key-admin-auth-bypass