Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

vlife up to 2.0.1 lets attackers gain admin access

CVE-2026-110612 · published 21 days ago
Summary

Versions of vlife up to 2.0.1 contain a hard‑coded signing key that lets anyone create a valid login token. An attacker could craft a token that claims super‑user rights and then access any page on the system as an administrator. Upgrade to a version that removes the hard‑coded key or replace the key and restrict token creation to trusted code.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wwwlike vlife <= 2.0.1
Original advisory text
vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-321Use of Hard-coded Cryptographic Key
Timeline
Published14 Oct 2026
Updated30 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-110612 · NVD
CVE-2026-110612 · MITRE
Track software like this
Free during beta