CVE-2026-125383

{
  "etk_id": "ETK-2026-4012",
  "cve_id": "CVE-2026-125383",
  "display_id": "CVE-2026-125383",
  "ghsa_id": "GHSA-rj9v-f992-cxp8",
  "euvd_id": "EUVD-2026-120546",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Hard-coded JWT key authentication bypass in Asp.Net-Core Inventory",
  "summary": "Asp.Net-Core-Inventory-Order-Management-System versions before 10.20261109 include JWT validation settings embedded in application configuration. An unauthenticated remote attacker may generate tokens accepted as selected users or roles, potentially obtaining administrative API access where the affected token validation is in use.",
  "mitigation": "Upgrade Asp.Net-Core-Inventory-Order-Management-System to version 10.20261109 or later. Replace and rotate any deployed JWT signing material, then invalidate tokens issued under the exposed configuration.",
  "vendor": "go2ismail",
  "product": "Asp.Net-Core-Inventory-Order-Management-System",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 10.20261109"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "10.20261109"
      ],
      "package_name": "Asp.Net-Core-Inventory-Order-Management-System",
      "purl": null
    }
  ],
  "cwes": [
    321
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 24.84472525,
  "t0_at": "2026-11-09T23:27:51.039000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-09T23:27:51.039000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T23:27:51.039000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-125383"
    }
  }
}