CVE-2026-125383: INDOTALENT WHMS before 10.20261109 Hard-Coded JWT Signing Key Authentication Bypass
INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Any deployment of INDOTALENT WHMS before 10.20261109 with its API reachable by an attacker is exposed. Exploitation does not require an existing account or other authentication.
What does an attacker need to exploit it?
An attacker needs network access to the API and the hard-coded JWT signing configuration from appsettings.json. They can forge a token containing a user ID and role accepted by the Tokens/DI.cs validator.
Does exploitation provide administrative access?
Yes. The available information states that attackers can forge tokens for any trusted user ID and role, including tokens that grant administrator access to the entire API.