CVE-2026-110612: vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Any unauthenticated remote attacker can exploit it. No prior account, privileges, or user interaction are required.
What level of access can a forged token provide?
An attacker can set the superUser claim to true and supply arbitrary groupIds claims, resulting in super administrator access to any URL on the affected vlife instance.
Are installations affected without a special configuration change?
The vulnerability is in the hardcoded HS256 JWT signing key used by TokenUtil. The provided information does not identify any configuration prerequisite, and the described attack applies to vlife instances through 2.0.1.