CVE-2026-111690 Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass
Attackers can forge JWT tokens using a hard-coded secret to gain full administrative control over the Simple Admin Core application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111690?
CVE-2026-111690 is a critical vulnerability in suyuan32 simple-admin-core, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.
Weakness: CWE-321
Which versions are affected by CVE-2026-111690?
How do I fix CVE-2026-111690?
No fix has been published for CVE-2026-111690 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-111690 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111690 exists.
Sources
Also known as GHSA-m87p-c3h7-7hr8.