CVE-2026-111690: Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.
Affected Software
Event History
Frequently Asked Questions
What prerequisites does an attacker need to exploit this issue?
An attacker does not need an account, privileges, or user interaction. They need to create a JWT signed with the publicly available hard-coded Auth.AccessSecret and set the roleId claim to 001.
Which deployments should be prioritized for remediation?
Simple Admin Core deployments through 1.8.7 that retain the hard-coded Auth.AccessSecret in api/etc/core.yaml are affected. Network-accessible deployments are especially exposed because the vulnerability has a network attack vector.