CVE-2026-110612

Deferred Deferred - Pending Action

Authentication Bypass via Hardcoded JWT Key in vlife

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110612

EUVD

EUVD-2026-101240

Affected Vendors & Products

Vendor	Product	Version / Range
wwwlike	vlife	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability is an authentication bypass in vlife through version 2.0.1 due to a hardcoded JWT secret in TokenUtil. Attackers can forge JSON Web Tokens using the hardcoded HS256 key 'mrin' to sign tokens with superUser=true and arbitrary groupIds claims, granting super administrator access to any URL on vulnerable vlife instances.

Detection Guidance

Check for unauthorized JWT tokens with superUser=true or arbitrary groupIds claims. Inspect TokenUtil.java for hardcoded secret 'mrin' at line 33. Look for unexpected admin-level access in logs or unusual URL access patterns.

Impact Analysis

Unauthenticated attackers can gain full administrative access to vlife instances, bypassing all authentication. This allows them to access sensitive data, modify configurations, execute privileged actions, and potentially take control of the entire platform without detection.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control in GDPR and HIPAA. It enables unauthorized access to sensitive data, undermines authentication mechanisms, and fails to implement proper security controls for protecting personal or health information.

Mitigation Strategies

Replace the hardcoded JWT secret 'mrin' with a unique per-deployment value. Update to the latest vlife version if available. Restrict network access to vlife instances and monitor for unauthorized admin access attempts.

Hi! I’m here to help you understand CVE-2026-110612. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70