CVE-2026-120201 in Jpom
Summary
by MITRE • 10/31/2026
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified in Jpom versions 2.10.0 through 2.11.12 represents a critical authentication bypass flaw rooted in the improper validation of user token headers during request processing. This security defect allows unauthenticated attackers to circumvent standard access controls and escalate their privileges to super-administrator level without possessing valid credentials. The core technical mechanism involves the manipulation of the JPOM-USER-TOKEN header, which is typically used by the application to identify and authenticate active users. By injecting specific query conditions into this header field, an attacker can exploit a parsing logic error within the underlying Hutool library's Condition parser. Specifically, when the value 'is not null' is submitted as part of the token data, the parser interprets it not merely as string content but as a logical operator or condition clause. This misinterpretation leads to a state where the authentication check effectively returns true for any subsequent request because the injected condition satisfies the internal validation logic in an unintended manner, thereby granting unauthorized administrative access.
The operational impact of this vulnerability is severe due to the high level of privilege granted upon successful exploitation. Once super-administrator access is obtained through this bypass, the attacker gains full control over the Jpom deployment environment. This includes the ability to manage projects, configure system settings, and critically, execute arbitrary commands via Jpom's built-in script execution features. The combination of authentication bypass and remote code execution capability transforms a simple identity management flaw into a complete system compromise. Attackers can leverage this access to install malware, exfiltrate sensitive data, pivot to other systems within the network, or disrupt service availability by modifying critical configurations. Because Jpom is often used for continuous integration and deployment pipelines, compromising it may also expose source code repositories, build artifacts, and associated infrastructure credentials stored in configuration files accessible through the administrative interface.
From a classification perspective, this vulnerability aligns with CWE-287, which denotes Improper Authentication, as the system fails to correctly verify the identity of users attempting to access protected resources. Furthermore, it relates to CWE-94, specifically Code Injection via improper control of configuration data or input, given that the injected token value influences how internal parsers process logic. In terms of adversary tactics, this exploit maps directly to MITRE ATT&CK technique T1078, Valid Accounts, where attackers use legitimate credentials or bypass authentication mechanisms to maintain persistent access. The subsequent execution of commands through script features corresponds to T1059, Command and Scripting Interpreter, indicating that the vulnerability facilitates immediate remote code execution capabilities rather than just passive information disclosure.
Mitigation strategies must prioritize immediate patching as the primary defense vector. Organizations running Jpom versions 2.10.0 through 2.11.12 should upgrade to a patched version where the Hutool Condition parser logic has been corrected to strictly validate token formats and prevent injection of SQL-like or logical operator syntax into authentication headers. In addition to software updates, network-level controls such as Web Application Firewalls can be configured to detect and block requests containing suspicious patterns in the JPOM-USER-TOKEN header, particularly strings resembling 'is not null' or other common injection payloads. It is also advisable to implement strict input validation on all user-supplied data that interacts with internal parsers, ensuring that only expected alphanumeric token formats are accepted. Regular security audits and penetration testing focused on authentication flows can help identify similar implementation flaws in custom web applications before they are exploited by malicious actors.