CVE-2026-108860

Katalog CVE

CVSS 9.1 · Critical EPSS 0,48%

Kerentanan Use of Hard-coded Cryptographic Key. Skor CVSS 3.1 9.1 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes.

Rincian

Terbit di NVD

11 Oktober 2026

Terakhir diubah

11 Oktober 2026

Status NVD

Received

CVSS 3.1

9.1 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-321: Use of Hard-coded Cryptographic Key

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/SciSharp/BotSharp
• https://github.com/SciSharp/BotSharp/blob/a11ee0317cab5c619df1cb5d0c4fc39d1b6e30b4/src/Infrastructure/BotSharp...
• https://github.com/SciSharp/BotSharp/blob/a11ee0317cab5c619df1cb5d0c4fc39d1b6e30b4/src/WebStarter/appsettings....
• https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/scisharp-botsharp-public-jwt-signing-key
• https://www.vulncheck.com/advisories/botsharp-through-5.2.0-authentication-bypass-via-hard-coded-jwt-signing-k...