Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck

CVE-2026-111367BillionMail through 4.9 Forgeable JWTs via Default Signing Key

Medium 6.5

In plain English

A medium-severity security flaw in BillionMail from aaPanel. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 73.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm to deactivate any contact or force confirmed subscriptions.

Affected products (as reported)

Vendor	Product	Versions
aaPanel	BillionMail	0 – through 4.9

Weakness: CWE-1394 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

https://hackmd.io/@hieuPenguinnn/billionmail-unsubscribe-subscribe-jwt-deterministic-secret-forgery third-party-advisory
https://github.com/aaPanel/BillionMail/blob/v4.9/core/internal/service/batch_mail/jwt.go#L98-L123 technical-description
https://github.com/aaPanel/BillionMail/blob/v4.9/core/manifest/config/config.yaml technical-description
https://github.com/aaPanel/BillionMail product
VulnCheck Advisory: BillionMail through 4.9 Forgeable JWTs via Default Signing Key third-party-advisory