ZKEACMS Users Risk Admin Takeover via Hard-Coded JWT Key in CVE-2026-111633
Unauthenticated users can create forged JWT tokens to access admin functions in ZKEACMS versions up to 4.4. No fix status is provided in the source material.
Key points
- CVE-2026-111633 affects ZKEACMS versions through 4.4 with a CVSS score of 8.8.
- Attackers can forge JWT tokens using a hard-coded HMAC-SHA256 signing key.
- The source material does not state whether a patch or fix has been released.
ZKEACMS versions through 4.4 are affected by a high-severity authentication bypass flaw that allows unauthenticated attackers to forge REST API JWT bearer tokens. The vulnerability, tracked as CVE-2026-111633, stems from a hard-coded HMAC-SHA256 signing key in the JwtBearerDefaults.cs file. The source material does not specify if a patch or update has been released to address this issue.
How it unfolded
- The National Vulnerability Database recorded CVE-2026-111633 with a CVSS score of 8.8, classifying it as HIGH severity.
- Researchers identified that the flaw involves a hard-coded HMAC-SHA256 signing key within the JwtBearerDefaults.cs source file.
- The vulnerability enables unauthenticated attackers to sign tokens with the Name claim set to 'admin' to access protected endpoints.
Who is affected
Organizations running SeriaWei ZKEACMS up to version 4.4 are exposed to this authentication bypass. The flaw allows attackers to call ApiAuthorize endpoints without valid credentials. According to the NVD record, this enables the modification of articles and products. Attackers can also read form submissions by forging tokens that claim administrative privileges. The weakness is classified under CWE-321.
Our take on the response
The presence of a hard-coded cryptographic key in the source code represents a significant architectural failure. That suggests the vendor needs to review their secret management practices urgently. The exposure remains total for any instance accessible to unauthenticated users. The high CVSS score reflects the ease of exploitation and the full control gained by attackers.
Who needs to act first
Teams should prioritize systems with public-facing API endpoints or those handling sensitive form data. Check whether your ZKEACMS instances are accessible from the internet without additional network controls. If no fix exists, consider restricting access to the API through firewall rules or IP whitelisting. Back up configuration files before making any manual changes to mitigate risk while waiting for an official update.
Background: Firewall rules
Firewall rules Linux systems use are ordered instructions that decide whether network packets enter or leave. They inspect source, destination, and protocol data. You must configure these rules to allow necessary services while blocking unauthorized access attempts.
Read the full guide: Firewall Rules Linux: How Packet Filtering Shapes Network Security
What to do and how to stay safe: ZKEACMS
- Audit all ZKEACMS installations to confirm if they are running versions up to 4.4.
- Restrict network access to the REST API endpoints to trusted IP addresses only.
- Monitor server logs for unauthorized token generation or unusual admin activity.
- Wait for the vendor to release an official patch before applying any unverified workarounds.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-111633?
The CVSS score is 8.8, which is classified as HIGH severity.
Which versions of ZKEACMS are affected?
ZKEACMS versions through 4.4 are affected by this vulnerability.
Is there a patch available for this flaw?
The source material does not state whether a patch or fix has been released.
