CVE-2026-110612
CRITICAL
CVSS 9.8
Published: 2026-10-14
Modified: 2026-10-14
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.
Quick Facts
| CVE ID | CVE-2026-110612 |
| CVSS Score | 9.8 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2026-10-14 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |
References
- https://github.com/wwwlike/vlife
- https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653…
- https://github.com/wwwlike/vlife/blob/4f03b19b91d82781939653…
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vlife-hardcoded-jw…
- https://www.vulncheck.com/advisories/vlife-through-2.0.1-aut…
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vlife-hardcoded-jw…