INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API.
| CVE | CVE-2026-125383 |
|---|---|
| Severidad | CRITICAL |
| CVSS | 9.8 / 10 |
| EPSS | 0.8% en 30 días (percentil 58) |
| CWE | CWE-321 |
| Exposición (Shodan) | sin hosts expuestos detectados actualmente |
Producto afectado
INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) 10.20261109
Producto derivado de la descripción (el CPE estructurado de NVD aún no está publicado).