Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111690Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass

Critical 9.8

In plain English

A critical-severity security flaw in simple-admin-core from suyuan32. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.6%top 52.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.

Affected products (as reported)

Vendor	Product	Versions
suyuan32	simple-admin-core	0 – through 1.8.7

Weakness: CWE-321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://hackmd.io/@hieuPenguinnn/simple-admin-core-hardcoded-jwt-accesssecret-admin-auth-bypass third-party-advisory
https://github.com/suyuan32/simple-admin-core/blob/v1.8.7/api/etc/core.yaml#L6-L8 technical-description
https://github.com/suyuan32/simple-admin-core/pull/382 issue-tracking, patch
VulnCheck Advisory: Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass third-party-advisory