CVE-2026-111690 in simple-admin-core
Summary
by MITRE • 10/16/2026
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The Simple Admin Core framework, specifically versions up through 1.8.7, suffers from a critical authentication bypass vulnerability rooted in improper handling of cryptographic secrets within its JSON Web Token (JWT) implementation. This flaw allows unauthenticated attackers to forge super administrator tokens by exploiting the hard-coded Auth.AccessSecret value stored in the api/etc/core.yaml configuration file. The presence of this static secret means that any individual with access to the source code or configuration files can derive the signing key required to generate valid authentication tokens, effectively neutralizing the intended security controls designed to restrict administrative privileges.
From a technical perspective, the vulnerability stems from the framework's reliance on a predictable and publicly accessible secret for signing JWTs rather than utilizing dynamic, environment-specific secrets that are not embedded in source code or configuration files under version control. By using the hard-coded Auth.AccessSecret, the system fails to ensure token integrity against unauthorized generation. Attackers can leverage this weakness by constructing a malicious JWT payload containing the roleId claim set to 001, which corresponds to the super administrator role identifier within the application's logic. When this forged token is presented to the server, it passes signature verification because the attacker knows the exact secret used for signing, thereby granting them full administrative control over users, roles, menus, API authorities, configuration settings, and existing tokens without needing valid credentials.
The operational impact of this vulnerability is severe, as it results in a complete compromise of the application's access control mechanisms. An adversary who exploits this flaw can assume the identity of a super administrator, allowing them to perform any action available to that role. This includes creating or modifying user accounts with elevated privileges, altering system configurations, accessing sensitive data stored within the administrative interface, and potentially using the compromised account as a foothold for further lateral movement within the network infrastructure. The ability to forge tokens also means that session hijacking is not required; instead, attackers can directly inject authentication credentials into their requests, bypassing login screens entirely.
This vulnerability aligns with CWE-798: Use of Hard-coded Credentials and CWE-287: Improper Authentication, as the root cause lies in the static nature of the secret key used for identity verification. In terms of attack vectors, this behavior is consistent with MITRE ATT&CK technique T1078: Valid Accounts, where attackers obtain legitimate credentials or tokens to maintain persistent access and evade detection by standard authentication monitoring systems. The exploitation does not require complex payload construction beyond basic JWT manipulation, making it accessible to a wide range of threat actors regardless of their technical sophistication level.
To mitigate this vulnerability, organizations must immediately update Simple Admin Core to version 1.8.8 or later where the issue has been addressed by removing hard-coded secrets and implementing dynamic secret management practices. In environments where upgrading is not immediately feasible, administrators should rotate any exposed credentials if possible and ensure that configuration files containing sensitive data are excluded from public repositories using .gitignore rules or similar access controls. Additionally, deploying Web Application Firewalls with JWT validation capabilities can help detect anomalous token structures, although this serves only as a compensating control rather than a fix for the underlying architectural flaw. Regular security audits focusing on credential management and secret storage practices should be conducted to prevent recurrence of such issues in future development cycles.