Skip to content
Heist/ feed
Back to feed
Critical

Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass

Type: advisorySources: OSV

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-111690
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 16:22 UTC · Revision 1

Source evidence

Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass

core-osv · Original source

Published 16 Oct 2026, 17:39 UTC

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.

osv:CVE-2026-111690
Complete source record
{
  "id": "622841458db26214b257674a0d8942478fd0f0ca809d0bc09ebd363ad159c0dc",
  "url": "https://osv.dev/vulnerability/CVE-2026-111690",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass",
    "summary": "Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.",
    "evidence": "osv:CVE-2026-111690",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-111690",
      "aliases": [
        "CVE-2026-111690"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/suyuan32/simple-admin-core",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "be3efe7fbb339738f4145512db28e588959b6098"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1.8.7"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1.8.7"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.8.7",
            "v1.8.6",
            "v1.8.4",
            "v1.8.2",
            "v1.8.1",
            "v1.8.0",
            "v1.7.9",
            "v1.7.7",
            "v1.7.6",
            "v1.7.5",
            "v1.7.4",
            "v1.7.3",
            "v1.7.2",
            "v1.7.0",
            "v1.6.13",
            "v1.6.12",
            "v1.6.11",
            "v1.6.8",
            "v1.6.7",
            "v1.6.6",
            "v1.6.5",
            "v1.6.4",
            "v1.6.3",
            "v1.6.2",
            "v1.6.1",
            "v1.6.0.1",
            "v1.6.0",
            "v1.5.8",
            "v1.5.7",
            "v1.5.6",
            "v1.5.5",
            "v1.5.4",
            "v1.5.3",
            "v1.5.2",
            "v1.5.1",
            "v1.5.0",
            "v1.4.10",
            "v1.4.9",
            "v1.4.8",
            "v1.4.6",
            "v1.4.4",
            "v1.4.3",
            "v1.3.12",
            "v1.3.11",
            "v1.3.10",
            "v1.3.8",
            "v1.3.7",
            "v1.3.6",
            "v1.3.5",
            "v1.3.3",
            "v1.3.2",
            "v1.3.1",
            "v1.3.0",
            "v1.2.8",
            "v1.2.5",
            "v1.2.4",
            "v1.2.3",
            "v1.2.2",
            "v1.2.0",
            "v1.1.6",
            "v1.1.5",
            "v1.1.4",
            "v1.1.3",
            "v1.1.2",
            "v1.1.1",
            "v1.1.0",
            "v1.0.14",
            "v1.0.13",
            "v1.0.12",
            "v1.0.11",
            "v1.0.10",
            "v1.0.9",
            "v1.0.7",
            "v1.0.6",
            "v1.0.5",
            "v1.0.4",
            "v1.0.3",
            "v1.0.2",
            "v1.0.0",
            "v0.3.2",
            "v0.3.2-beta",
            "list",
            "v0.3.1",
            "v0.3.0",
            "v0.2.9",
            "v0.2.9-beta",
            "v0.2.8",
            "v0.2.7",
            "v0.2.7-beta",
            "v0.2.6",
            "v0.2.5-beta",
            "v0.2.5",
            "v0.2.4",
            "v0.2.4-beta",
            "v0.2.3",
            "v0.2.2",
            "v0.2.1-beta",
            "v0.2.0",
            "v0.2.0-beta",
            "v0.1.9",
            "v0.1.8",
            "v0.1.7",
            "v0.1.6",
            "v0.1.5",
            "v0.1.4",
            "v0.1.4-beta",
            "v0.1.3",
            "v0.1.2",
            "v0.1.1",
            "v0.1.0",
            "v0.0.9",
            "v0.0.8.1",
            "v0.0.8",
            "v0.0.7",
            "v0.0.7-beta",
            "v0.0.6",
            "v0.0.5",
            "v0.0.4",
            "v0.0.2",
            "v0.0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111690.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:30.324122575Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111690.json",
        "https://hackmd.io/@hieuPenguinnn/simple-admin-core-hardcoded-jwt-accesssecret-admin-auth-bypass",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-111690",
        "https://www.vulncheck.com/advisories/simple-admin-core-through-1.8.7-hard-coded-jwt-secret-authentication-bypass",
        "https://github.com/suyuan32/simple-admin-core/pull/382",
        "https://github.com/suyuan32/simple-admin-core",
        "https://github.com/suyuan32/simple-admin-core/blob/v1.8.7/api/etc/core.yaml#L6-L8"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-321"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111690.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-111690",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 497323,
  "published_at": "2026-10-16T17:39:46.96+00:00"
}