CVE-2026-111367
Received Received - Intake

Hard-Coded JWT Key in BillionMail

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description
BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm to deactivate any contact or force confirmed subscriptions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111367

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aaPanel BillionMail 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1394 The product uses a default cryptographic key for potentially critical functionality.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

BillionMail through version 4.9 has a hard-coded cryptographic key flaw. Attackers can compute this key from configuration constants to forge unsubscribe and subscribe-confirm JWTs without authentication. This allows them to manipulate subscription states by submitting fake tokens to specific API endpoints.

Detection Guidance

Detecting this vulnerability requires checking for hard-coded cryptographic keys in BillionMail configurations. Inspect configuration files for hard-coded JWT keys or secrets in files like /etc/billionmail/config.json or similar paths. Monitor network traffic for unusual JWT tokens in requests to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm endpoints.

Impact Analysis

Unauthenticated attackers could deactivate any contact by forging unsubscribe tokens or force confirmed subscriptions via forged subscribe-confirm tokens. This disrupts email list management and may lead to unauthorized changes in subscriber status.

Mitigation Strategies

Immediately update BillionMail to the latest version that patches the hard-coded key issue. Rotate all JWT secrets and cryptographic keys used by BillionMail. Review and revoke any tokens generated with the old keys. Restrict access to configuration files containing sensitive keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111367. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart