CVE-2026-125383
CriticalCVSS 9.8Summary
INDOTALENT WHMS before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API.
Risk Assessment
An attacker can forge administrative tokens and gain full API access without logging in. This leads to takeover of the entire system and its data.
Recommendation
Update the system to version 10.20261109 or later and replace hard-coded JWT keys with unique, securely stored secrets. Consider key rotation and token auditing.
Other vulnerabilities in INDOTALENT WHMS
See all- CVE-2026-125385Medium
INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without containment checks, to read files like appsettings.json.
- CVE-2026-125384Critical
INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability because the UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.
Original NVD description (English source)
INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS