CVE-2026-111633
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.
Risk Assessment
An unauthenticated attacker can gain administrator privileges, modify content (articles, products) and read form submissions, compromising data integrity and confidentiality.
Recommendation
Upgrade ZKEACMS beyond 4.4 and replace the hard-coded HMAC-SHA256 signing key with a unique, random key stored securely.
Other vulnerabilities in ZKEACMS
See all- CVE-2025-52239Critical
An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file.
- CVE-2025-10471Medium
A vulnerability was detected in ZKEACMS 4.3 in the Proxy function of MediaController.cs. Manipulating the url argument results in server-side request forgery. The attack can be initiated remotely and the exploit is publicly available.
Original NVD description (English source)
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS