CVE-2026-111633: ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key

Q: What does an attacker need to exploit this issue?

An attacker needs only network access to a vulnerable ZKEACMS instance. No valid account, credentials, or user interaction are required because the JWT signing key is hard-coded.

Q: Which API access can be obtained with a forged token?

A forged JWT with the Name claim set to 'admin' can call ApiAuthorize endpoints. This can allow modification of articles and products and access to form submissions.

Q: How can defenders determine whether their deployment is affected?

Deployments running ZKEACMS through version 4.4 are affected. The vulnerable JWT signing-key handling is located in JwtBearerDefaults.cs.

Published Oct 16, 2026

Updated

ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.

Affected Software

1 affected component

ZKEACMS ZKEACMS<=4.4

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs only network access to a vulnerable ZKEACMS instance. No valid account, credentials, or user interaction are required because the JWT signing key is hard-coded.

Which API access can be obtained with a forged token?

A forged JWT with the Name claim set to 'admin' can call ApiAuthorize endpoints. This can allow modification of articles and products and access to form submissions.

How can defenders determine whether their deployment is affected?

Deployments running ZKEACMS through version 4.4 are affected. The vulnerable JWT signing-key handling is located in JwtBearerDefaults.cs.

CVE-2026-111633: ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which API access can be obtained with a forged token?

How can defenders determine whether their deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which API access can be obtained with a forged token?

How can defenders determine whether their deployment is affected?