CVE-2026-111633 Overview
ZKEACMS through version 4.4 contains an authentication bypass vulnerability caused by a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Unauthenticated attackers can forge REST API JSON Web Token (JWT) bearer tokens by signing them with the embedded key. Setting the Name claim to admin grants access to ApiAuthorize endpoints. This permits attackers to modify articles and products and read form submissions without valid credentials. The flaw is tracked under CWE-321: Use of Hard-coded Cryptographic Key.
Critical Impact
Remote unauthenticated attackers can impersonate administrators across the ZKEACMS REST API and tamper with site content.
Affected Products
- ZKEACMS versions through 4.4
- Deployments exposing the REST API ApiAuthorize endpoints
- Instances running the default JwtBearerDefaults.cs configuration
Discovery Timeline
- 2026-10-16 - CVE-2026-111633 published to the National Vulnerability Database (NVD)
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-111633
Vulnerability Analysis
ZKEACMS ships with a static HMAC-SHA256 signing secret embedded in src/ZKEACMS/Api/JwtBearerDefaults.cs. The CMS reuses this key across every deployment to validate inbound JWTs on API endpoints protected by the ApiAuthorize attribute. Because the key is public in the source repository, any attacker can produce a cryptographically valid token. The token validation routine in BuilderAuthentication.cs accepts the forged signature and establishes an authenticated session.
Once authenticated as admin, the attacker gains write access to article and product data and read access to collected form submissions. The impact includes content defacement, data integrity loss, and exposure of user-submitted information.
Root Cause
The root cause is the storage of a long-lived symmetric signing secret directly in version-controlled source code. Every installation inherits the identical key, eliminating the entropy that JWT bearer authentication relies on for identity assurance.
Attack Vector
Exploitation occurs over the network without any user interaction or prior privileges. An attacker retrieves the hard-coded key from the public GitHub repository, crafts a JWT with the Name claim set to admin, signs it with HMAC-SHA256, and sends it as a Bearer token in the Authorization header to any ApiAuthorize-protected endpoint. The server validates the forged signature and processes the request with administrative authority.
Technical analysis is available in the HackMD write-up and the VulnCheck advisory. The vulnerable code paths are documented in the JwtBearerDefaults.cs source and the BuilderAuthentication.cs source.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-111633
Indicators of Compromise
- Inbound HTTP requests to /api/* endpoints containing Authorization: Bearer headers from unexpected source IP addresses
- Unexplained modifications to article, product, or page records with no corresponding administrative login event in CMS audit logs
- Access to form-submission endpoints originating from non-administrative user agents or automated clients
- JWT tokens where the Name claim equals admin but no matching administrator session exists in application state
Detection Strategies
- Decode Authorization bearer tokens at the reverse proxy or WAF and alert on JWTs whose iss, aud, or signing key metadata matches the default ZKEACMS configuration
- Correlate API write operations on ApiAuthorize routes with interactive admin logins; the absence of a login prior to an API change indicates forged-token activity
- Monitor for anomalous spikes in 200 OK responses on ApiAuthorize endpoints from previously unseen clients
Monitoring Recommendations
- Enable verbose request logging on the ZKEACMS web tier and forward logs to a centralized analytics platform for retention and correlation
- Hash and track known-good administrator JWTs; alert on any valid token outside that allowlist
- Baseline normal API traffic patterns and apply anomaly detection to /api/article, /api/product, and form-submission routes
How to Mitigate CVE-2026-111633
Immediate Actions Required
- Replace the hard-coded signing key in JwtBearerDefaults.cs with a cryptographically random secret stored outside source control, such as in environment variables or a secrets manager
- Invalidate all existing JWTs by rotating the signing key and forcing re-authentication for legitimate API clients
- Restrict network access to /api/* endpoints to trusted source ranges until a permanent fix is deployed
- Review CMS content and form-submission tables for unauthorized changes since the vulnerable version was deployed
Patch Information
At the time of publication, no vendor patch is referenced in the NVD entry. Track remediation status in the upstream GitHub issue tracker and the VulnCheck advisory. Operators should rebuild from source with a locally generated signing key until a fixed release is published.
Workarounds
- Override the default JwtBearerDefaults key at application startup by injecting a per-deployment secret through configuration providers
- Disable the JWT bearer authentication scheme entirely if the REST API is not required, and remove ApiAuthorize route registrations
- Place the application behind a reverse proxy that enforces mutual TLS or an additional authentication layer on /api/* paths
# Configuration example - rotate the JWT signing key via environment variable
export ZKEACMS_JWT_SIGNING_KEY="$(openssl rand -base64 64)"
# Reference the environment variable in JwtBearerDefaults.cs instead of a hard-coded literal
# Restart the ZKEACMS application to invalidate all previously issued tokens
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
