CVE-2026-108860: BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker does not need an account or prior authentication. They need the committed HMAC signing secret and the fixed BotSharp issuer and audience, plus the identity of a user they want to impersonate.
Which accounts and endpoints are at risk?
Any known user can be impersonated, including administrators. The forged bearer tokens can be used against API routes protected by Authorize.
Are deployments running version 5.2.0 affected?
Yes. The affected range includes BotSharp through version 5.2.0, where the WebStarter appsettings.json contains the hard-coded Jwt:Key.