BotSharp: Authentication bypass via hard-coded JWT signing key

Summary

BotSharp through 5.2.0 ships a hard-coded JWT signing key (Jwt:Key) in the WebStarter appsettings.json. Unauthenticated remote attackers can sign their own bearer tokens with this key and impersonate any known user, including administrators, on Authorize-protected API routes. The issue affects the default configuration, and no patched version has been published.

Affected

• SciSharp BotSharp 0 to and including 5.2.0
• Default WebStarter configuration (appsettings.json)

Fixed in

Unknown. No patched version has been published by the vendor.

Workaround

• Replace the hard-coded Jwt:Key with a secret that is not stored in source control, and rotate it. Rotation invalidates tokens forged with the old key.
• Restrict network access to the BotSharp instance, especially to Authorize-protected API routes.

Exploitation

• Known exploited: no (not listed in CISA KEV as of this entry).
• Public proof of concept: none confirmed in the sources.
• The key is public in the repository, so exploitation requires no credentials and little effort.
• CISA SSVC: automatable yes, technical impact total.

Our recommendation

• Check whether BotSharp WebStarter is deployed and whether the default appsettings.json is used in production.
• If it is, replace and rotate the Jwt:Key, and restrict access to the API from untrusted networks.
• Monitor logs for unexpected administrative activity.
• Check your other repositories and deployment templates for committed JWT secrets, and review any agent products built from this starter.
• Watch the vendor's releases for a fix and apply it as soon as it is available.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• HackMD write-up (CVE reference) hackmd.io
• BotSharp GitHub repository github.com
• WebStarter appsettings.json at commit a11ee03 github.com
• BotSharpOpenApiExtensions.cs at commit a11ee03 github.com
• Forkast News analysis forkast.news
• TheHackerWire advisory www.thehackerwire.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:32.