Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

BotSharp 5.2.0 lets attackers impersonate any user

CVE-2026-108860 · published 7 days ago
Summary

BotSharp up to version 5.2.0 includes a default secret that is used to sign login tokens. Because the secret is fixed and publicly known, a remote attacker can create a valid token and act as any user, even an administrator, on protected parts of the system. Upgrade to a newer release or replace the default secret with a strong, private value and restart the application.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
scisharp botsharp <= 5.2.0
Original advisory text
BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-321Use of Hard-coded Cryptographic Key
Timeline
Published11 Oct 2026
Updated15 Oct 2026
First seen11 Oct 2026
Sources
CVE-2026-108860 · NVD
CVE-2026-108860 · MITRE
Track software like this
Free during beta