CVE-2026-111367 BillionMail through 4.9 Forgeable JWTs via Default Signing Key
Unauthenticated attackers can forge JWTs using a hard-coded key to modify contact subscriptions and bypass authentication in BillionMail.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111367?
CVE-2026-111367 is a medium-severity vulnerability in aaPanel BillionMail, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm to deactivate any contact or force confirmed subscriptions.
Weakness: CWE-1394
Which versions are affected by CVE-2026-111367?
How do I fix CVE-2026-111367?
No fix has been published for CVE-2026-111367 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-111367 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111367 exists.
Sources
Also known as GHSA-h86v-9fhw-gvch.