CVE-2026-111633 ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key
Unauthenticated attackers can forge JWT tokens using a hard-coded key to gain admin access and modify or read data in ZKEACMS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111633?
CVE-2026-111633 is a high-severity vulnerability in SeriaWei ZKEACMS, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.
Weakness: CWE-321
Which versions are affected by CVE-2026-111633?
How do I fix CVE-2026-111633?
No fix has been published for CVE-2026-111633 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-111633 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111633 exists.
Sources
Also known as GHSA-4v4h-58rp-w43w.