xianhc ape-volo-admin, CVE-2026-120442: a new CVE scored 9.8

The bottom line

Any team running ape-volo-admin before 3.6.1 should update this week: the record scores this 9.8 and no login is needed to exploit it. Update to 3.6.1, released 31 October 2026; if you do not run this software, you can stop reading.

Free analysis report · 9 pagesxianhc ape-volo-admin, CVE-2026-120442: a new CVE scored 9.8The same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

An attacker can forge a valid administrator token entirely offline, without ever connecting to the system, by using a signing key that the record says is hardcoded in the application's configuration file. With that token they gain full API control over users, roles, permissions and data.

Why it matters

CWE-1394 (use of a hardcoded cryptographic key) means the attack requires no network position and no brute force: anyone who can read the source can sign a token. The score of 9.8 reflects that no authentication whatsoever is needed. Our reading is that the risk is not limited to internet-facing deployments — any insider or compromised host that can reach the API at all can escalate to full administrator access once the key is known, and the key is fixed in code.

What the vendor's advisory says

We read two pages on github.com. In short:

• The GitHub release notes for V3.6.1, dated 31 October 2026, describe a major refactoring of the application and an upgrade to .NET 10, merging the front and back-end source trees into a single repository.
• The release notes include a BREAKING CHANGE notice: project paths, API routes and configuration structure have all changed, and existing deployments and callers must adapt before upgrading.
• The release notes state that the release also addresses security issues in role assignment, menu links, rate limiting and monitoring access, though no separate CVE identifiers are given for those items.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• Attackers need network access to the running system to exploit this. The record says tokens can be forged entirely offline. An attacker needs only the hardcoded signing key and the administrator account ID, both obtainable without touching the live system.
• Blocking the admin API from the internet removes the risk. Restricting external access reduces exposure but does not remove the flaw. Any insider or compromised internal host that can reach the API can still present a forged token. The fix is updating to 3.6.1.

How we would triage it

This is our judgement.

Step 1: Find the version installed

• Check the application's startup log, deployment manifest, or about endpoint for the version string.
• If deployed from source, check the git tag or the project file for the version number.

Step 2: Restrict access while you prepare the update

• If the admin API is reachable from outside your trusted network, block it at the firewall or reverse proxy until the update is applied.
• The record says the flaw gives full API control over users, roles, permissions and data; treat any untrusted access path as live exposure until patched.

Step 3: Update to 3.6.1

• The vendor's release notes for V3.6.1 flag a BREAKING CHANGE: project paths, API routes and configuration structure have changed. Review the release notes before deploying.
• Update to 3.6.1, released 31 October 2026, which the vendor confirmed on 2 November 2026 resolves this vulnerability.

Step 4: Verify the update

• Confirm the running version is 3.6.1 after deployment.
• Review admin API logs for any unexpected calls to user, role or permission endpoints, particularly from unfamiliar addresses or outside normal working hours.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

We are writing regarding CVE-2026-120442, a 9.8-severity authentication bypass in xianhc ape-volo-admin affecting all versions before 3.6.1. The record states that an attacker can forge administrator tokens offline using a hardcoded signing key, giving full API access to users, roles, permissions and data without any login. Could you confirm whether we run this application, which version is installed, and whether it has been updated to 3.6.1, released 31 October 2026? Please send us written confirmation of the version in use and the status of the fix by 10 November 2026.

The weakness behind it

The record classes this as CWE-1394.

The sources, in their words

The CVE record:

ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administrator id to gain full API control over users, roles, permissions and data.

Versions of xianhc ape-volo-admin the record lists as affected:

• all versions up to, but not including, 3.6.1

Check your own project

If you build software, you can compare what a project declares with this CVE from a terminal. The tool reads requirements files, package.json, Maven, Gradle, Cargo, CMake and Dockerfile files, runs nothing, and only the CVE id leaves your machine. Naming the CVEs needs no key.

lattice-scan project . --cve CVE-2026-120442

Each row says in-range, outside-range, undetermined or lead, with the file and line. That is evidence about what a manifest declares, not about what runs, and a person decides. The verdicts, the CSV columns and a pipeline recipe are in the guide.

Check the servers you run

The same id can be checked against a host. Run this on the machine itself, not on the laptop that deploys to it: it reads installed packages (dpkg, rpm or apk), snaps, the names of running container images and the kernel version, compares them on the spot, and only the CVE ids leave the machine; the inventory stays on it, in ~/.lattice-scan. Naming the CVEs needs no key. Do it on each server after a deployment, and again when a new entry lands.

lattice-scan --cve CVE-2026-120442

A match is a candidate for a person to confirm, not a finding. A distribution can fix a CVE under an unchanged version number, so a match is a candidate; on Debian-family hosts the report also shows whether the package's own changelog names the CVE. It reads the names of the running images, not what is inside them; for what an image declares, use the project check on its Dockerfile.

Guide: namiq.io/lattice/guides/choose-your-channel. MCP server (io.namiq/lattice in the MCP registry): namiq.io/lattice. Package: pypi.org/project/lattice-scan, or namiq.io/apt.

• Which way into Lattice fits your job →The command line, the Claude skill or the MCP server: what each needs, what works without a key and how to read the result.
• Lattice, the MCP server →The public graph the command reads, for AI agents over MCP.
• Install and connect →The signed apt repository, the fingerprint, and the connection commands for each client.

What we do not know yet

• The sources do not say whether the hardcoded signing key is the same value across all installations or differs per deployment.
• The sources do not say whether administrator tokens forged before the fix remain valid after upgrading to 3.6.1, or whether existing sessions must be explicitly revoked.
• The sources do not give CVE identifiers for the other security issues addressed in the V3.6.1 release alongside this one.
• The sources do not say when the hardcoded key was introduced, so it is unclear whether versions earlier than 3.5.2 are also affected.
• Exploitation is not recorded. That is not the same as none.
• This is a new record: scores, versions and wording can change in the first days, and they are as at 3 November 2026. We read the vendor pages listed under Sources; nothing here has been tested.
• The sections headed "The bottom line", "Does this apply to you?", "What it is", "Why it matters", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• The day's CVE highlight →The three new records we picked that day, and how we chose them.
• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.