CVE-2026-125383
Received Received - Intake

Authentication Bypass in INDOTALENT WHMS via Hard-Coded JWT Key

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulnCheck

Description
INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125383
EUVD
EUVD-2026-120546

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
go2ismail Asp.Net-Core-Inventory-Order-Management-System From 0 (inc) to 10.20261109 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) versions before 10.20261109. It stems from hard-coded JWT signing keys, issuer, and audience values in the appsettings.json file. Attackers can forge tokens to impersonate any user ID and role, gaining full administrator access to the API without authentication.

Detection Guidance

Check the appsettings.json file in INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) for hard-coded JWT signing keys, issuer, or audience values. Search for files containing 'appsettings.json' or inspect the application's configuration files for these values.

Impact Analysis

Unauthenticated attackers can exploit this to gain complete control over the system, accessing sensitive data, modifying records, or disrupting operations. The high CVSS score (9.8) indicates severe impact, including confidentiality, integrity, and availability breaches.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection (GDPR, HIPAA) due to unauthorized access risks. It compromises confidentiality and integrity of sensitive data, potentially leading to regulatory penalties, data breaches, and loss of trust.

Mitigation Strategies

Remove any hard-coded JWT signing keys, issuer, or audience values from appsettings.json. Regenerate all JWT tokens with a new secure signing key and update the issuer and audience values. Ensure tokens are validated properly with dynamic configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125383. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...